Anthropic's Claude VS Code extension v2.1.313 backdoored on Cursor marketplace for about 11 hours, affecting up to 5,000 users

A malicious version 2.1.313 of Anthropic's Claude VS Code extension was published through Anthropic's official account on Cursor's extension marketplace on Thursday, live for about 11 hours (roughly 5:27 am to 4:35 pm ET). It tried to install a persistent SSH backdoor (an attacker's key, a reverse SSH tunnel, and persistence via a LaunchAgent or scheduled task) and sent host details to an attacker's server. Cursor says at most 5,000 users were affected. It cut off the attacker's server with the hosting provider, removed the bad version, briefly shut the marketplace to rotate keys and audit access, and Anthropic then pushed clean version 2.1.314. How the attackers took over the account is not yet known.

Anyone who installed or auto-updated to 2.1.313 on Cursor in that window should treat the machine as potentially compromised, because the code was aimed at developer laptops holding source code and cloud credentials. In practice that means checking the installed version, looking for the unexpected SSH keys, tunnels and persistence entries described, and rotating credentials. The broader lesson is that a trusted vendor's official publisher account is a single point of failure, and auto-updating extensions inherit that risk. The measured harm looks limited: a short window, a capped user count, and bugs in the malware that stopped the backdoor working in some cases.

The "up to 5,000" figure is Cursor's own upper bound, not a verified count of compromised machines, and the report links no primary advisory or indicators. Framing this as an AI-specific failure is a stretch: it is a standard supply-chain account compromise that happened to hit an AI vendor's extension, and there is no sign Claude models or Anthropic's wider systems were affected. The criticism that Anthropic has not warned customers is fair but rests on the absence of a statement so far, which may change.

1. 01A post-incident report from Anthropic or Cursor explaining how the publisher account was taken over, and whether the same access reached other extensions or marketplaces.
2. 02Published indicators of compromise (attacker SSH key, server address, persistence file names) and any confirmed cases of the backdoor working, especially in enterprise environments.
3. 03Whether Anthropic issues a direct customer notice and whether Cursor changes marketplace controls, for example mandatory 2FA, signed releases or delayed auto-updates, within the next few weeks.