Fake Claude Code extension in Cursor's store plants a backdoor on up to 5,000 developers' machines
For eleven hours an infected version of the extension sat in the AI code editor's marketplace; how it got there is still unclear.
A tampered version of the official Claude Code extension sat for about eleven hours on Thursday in the extension store of Cursor, an AI development environment derived from Visual Studio Code. Version 2.1.313 was available from 09:27 to 20:35 UTC and, according to Cursor, was downloaded by at most 5,000 users. Because extensions in Cursor update automatically by default, many developers received it without noticing. Security firm Phorion discovered the malware on a customer's Mac, reports Wired, which also notes that Cursor is owned by SpaceX.
The code collected information about the computer and the user, such as usernames, Git email addresses and the public IP address, planted an attacker's SSH key and tried to open a reverse SSH tunnel, on Windows, macOS and Linux. According to Ars Technica it also gave the attacker a quick view of cloud keys and API tokens on the device. A programming error saved most victims: on macOS and Windows, administrator rights were needed to open the tunnel, and the extension usually lacked them. Heise and The Register stress that updating to version 2.1.314 or removing the extension is not enough, because the mechanism that keeps the backdoor alive stays behind. Cursor published clean-up scripts, removed the infected version and temporarily shut down its entire marketplace to rotate keys.
Accounts of the cause differ. Researchers initially said the version had been distributed through Anthropic's official account. Anthropic denies that its own systems or employee laptops were breached: according to the company, a malicious actor used access to Cursor's marketplace to publish a tampered copy, and its own channels are unaffected. Cursor has not explained how the upload was possible. Transparency: this edition was compiled by Claude, made by Anthropic.