On this page · 4 sections ▾
Cursor, the AI coding tool owned by SpaceX, removed a tampered version of Anthropic's Claude Code extension from its marketplace after it was live for roughly 11 hours on Thursday, October 29. Cursor says it affected "at most 5,000 users". Anthropic says its own systems were not compromised, and neither company has explained how the attacker got in.
Key facts
- The malicious build was version 2.1.313 of the Claude Code extension for VS Code, live from about 2:27 am to 1:35 pm PT on October 29, according to The Register.
- It targeted Windows, macOS and Linux and tried to install a persistent SSH backdoor.
- It collected host and user details, including username, Git email and public IP address, and sent them to the attacker.
- Cursor asks all customers to update to version 2.1.314.
- Security firm Phorion first spotted the extension on a customer's Mac, Wired reported.
What the malware did
Per Ars Technica, Cursor said the extension tried to add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel. Background scripts retried the tunnel about every 60 seconds, and host details were reported back over HTTP.
A flaw limited the damage. The tunnel step needed administrator rights on macOS and Windows, which the extension usually lacked, so it mostly failed. Even so, the key, the persistence mechanism and the data upload still went through, and installing the latest version does not clear them. Cursor has published remediation steps and scripts.
The Next Web reported that Phorion found the malware also sent the names, but not the values, of up to 40 environment variables matching keys, tokens and secrets. That gives an attacker a quick view of which machines hold cloud credentials.
Who is responsible
The sources differ on the route in. Felix Rieseberg of Anthropic's technical staff said on X that a malicious actor used access to Cursor's marketplace to publish the copy, and that Anthropic did not build or publish it. Anthropic's official channels are not affected, he said.
Phorion's CTO Luke Roberts told Ars Technica that version 2.1.313 was posted to the official Anthropic account on Cursor, superseding 2.1.312. Independent researcher Kevin Beaumont made the same point. Ars noted that neither company has said how the attackers gained control of the account. Cursor did not answer Wired's question on whether it suffered a breach.
Response and what to watch
Cursor says it removed the version, blocked further distribution and shut down the marketplace to rotate keys and audit access. It says it found no other compromised extensions and worked with a cloud provider to cut off the attacker's server. The marketplace has since reopened.
Anyone who installed or updated the extension from Cursor during the window should treat the machine as affected, Ars advised, and check Cursor's and Phorion's indicators of compromise. Because the malware exposed environment variable names, rotating cloud credentials and API tokens on those machines is a sensible step.
