Backdoored Claude Code extension on Cursor marketplace hit up to 5,000 users

A backdoored version of Anthropic's Claude Code extension for VS Code was distributed through the Cursor marketplace on Thursday and threatened as many as 5,000 developers' machines, according to multiple sources cited by Ars Technica. Cursor said the malicious release, version 2.1.313, affected at most 5,000 users. Cursor has removed it from the marketplace and blocked further distribution.

Researcher Kevin Beaumont said Anthropic pushed version 2.1.314 several hours after the bad release appeared. Beaumont and Luke Roberts, CTO and co-founder of security firm Phorion, said 2.1.313 went out through Anthropic's official Cursor account, superseding 2.1.312. Extensions auto-update in Cursor by default, though users can change that setting.

According to Cursor, the extension tries to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service and opening a reverse SSH tunnel. Phorion's analysis says the malicious code is an injected function prepended to extension.js, so it runs as soon as the file loads, before the extension's normal startup and without user interaction. The key carries the comment svc-telemetry.

The malware contains bugs. On macOS it runs systemsetup -getremotelogin without administrator rights, gets an error message instead of the word Off, and so skips the step that would enable SSH. Phorion says a Windows path also fails because it passes a PowerShell command through a helper hardcoded to /bin/sh. Even so, Phorion says keys and persistence are still installed and host reconnaissance is sent to the operator.

The incident is a supply-chain attack through an official distribution channel, not a lookalike package. Because Cursor extensions run with the permissions of the editor and the user, a malicious one can reach local files, source code and developer tooling. Phorion said stolen variable names would let the operator inventory cloud credentials and API tokens on a machine, probably to choose targets for follow-up attacks.

The attack also touches the AI coding tool ecosystem, where developer machines often hold cloud keys and tokens. Ars Technica notes that neither company has said how attackers took control of Anthropic's verified account, and Anthropic has not publicly notified customers. Until that is explained, it is unclear whether the weakness lay with Anthropic's credentials or with Cursor's marketplace.

Cursor says it shut down the VSCode Marketplace to rotate keys, audit access controls and confirm no other extensions were compromised; the marketplace has since reopened. The results of that audit have not been published.

Affected users should check Cursor's and Phorion's indicators of compromise, which include IP addresses and cryptographic hashes. Phorion advises checking the public-key fingerprint rather than relying on the svc-telemetry comment, and engaging incident response where version 2.1.313 was used.