Anthropic VS code extension on Cursor backdoored for nearly 12 hours

The compromised package, version 2.1.313 of the Claude extension, was pushed from Anthropic’s official account on the Cursor extension store. When users’ IDEs auto‑updated— the default setting in Cursor— the code silently added an attacker‑controlled SSH key, enabled the local SSH daemon, and opened a reverse tunnel, giving the intruder full file‑system and tooling access on Windows, macOS, and Linux workstations. Independent researcher Kevin Beaumont and Phorian’s CTO Luke Roberts traced the supply‑chain breach to the official distribution channel, but neither Anthropic nor Cursor has explained how the account was hijacked. The rapid release of a clean version (2.1.314) limited exposure, yet the episode shows that even vetted AI‑assisted development tools can become vectors for credential theft.

The incident arrives amid a wave of supply‑chain compromises targeting software that developers trust implicitly— from npm packages to container images. AI‑driven coding assistants like Claude are being integrated directly into IDEs, blurring the line between user‑level plugins and core development infrastructure. Cursor’s model of offering AI extensions through a centralized marketplace amplifies the attack surface: a single compromised publisher account can affect thousands of developers instantly. Competitors such as GitHub Copilot and Tabnine have emphasized hardened publishing pipelines, but the race to embed large‑language models into everyday tooling has outpaced robust security governance across the ecosystem.

Going forward, organizations must treat AI extensions as critical software components, enforcing strict version pinning, manual review of auto‑updates, and runtime monitoring for unexpected network connections. The lack of an official Anthropic advisory suggests a gap in incident‑response communication that could erode trust in AI vendors. Security teams should audit SSH configurations on developer machines, revoke any unknown keys, and consider network segmentation to contain potential reverse tunnels. Watch for follow‑up disclosures from Anthropic about the breach vector, and for broader industry moves toward signed extensions and supply‑chain attestation standards.