Anthropic Cursor Extension Compromised for Nearly 12 Hours
A malicious version of an official Anthropic extension on Cursor potentially exposed up to 5,000 developer machines to unauthorized access.
An official extension for Anthropic's Claude model distributed on the Cursor marketplace was recently compromised, exposing thousands of developer machines to potential security threats over a nearly 12-hour window.
The Incident and Distribution
The security event involved version 2.1.313 of the extension, which affected up to 5,000 users. According to independent researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian, the malicious package was distributed directly through Anthropic's official account on Cursor. This incident constituted a supply-chain compromise where unauthorized actors gained access to the legitimate distribution channel.
Because Cursor extensions automatically update by default—unless users manually change this behavior in their settings—many systems fetched and installed the flawed update automatically. Anthropic eventually pushed out a corrective update, version 2.1.314, several hours after the malicious software went live. Neither Anthropic nor Cursor has publicly explained how the attackers managed to take control of the official account, and Anthropic had not issued a public customer warning about the incident as of Friday.
Potential Impact on Developer Systems
Security analysis revealed that the compromised extension attempted to establish a persistent SSH backdoor. This involved adding an attacker-controlled SSH key, enabling the local SSH service, and establishing a reverse SSH tunnel. The underlying script was engineered to function across Windows, macOS, and Linux operating systems.
Because extensions in Cursor operate using the permissions of the Integrated Development Environment, the malicious code likely gained access to local files, source code, and various developer tooling on affected machines. Phorian noted that the malicious package actively searched for cloud credentials.
What it means for developers
This supply-chain attack highlights the inherent risks of automated extension updates and third-party IDE integrations in modern software development workflows. Developers should regularly review their automated update settings, monitor local SSH configurations for unauthorized keys, and audit their environment permissions. For developers looking to integrate intelligence safely, platforms like Apixo offer an alternative by letting developers try top AI models cheaply through one API at https://apixoai.online, minimizing reliance on vulnerable local extension packages.
Source: Anthropic VS code extension on Cursor backdoored for nearly 12 hours — Ars Technica AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
