Anthropic’s Cursor Extension Was Backdoored for Nearly 12 Hours

Introduction

A VS Code extension distributed through Anthropic’s official account on Cursor was found to contain a supply-chain backdoor. Version 2.1.313 was available for nearly 12 hours and may have affected up to 5,000 developers. Because Cursor enables extension auto-updates by default, exposure was not limited to users who deliberately selected the malicious release.

What happened

The compromised package was published through Anthropic’s verified Cursor account and effectively replaced version 2.1.312. Anthropic later released version 2.1.314. Security researchers cited in the report said the incident was a compromise of the official distribution channel, although neither Anthropic nor Cursor has explained how the account was accessed.

The malicious code was designed to gather reconnaissance data, including the hostname, username, operating system, system architecture, home-directory path, environment-variable names, working directories, configured Git email, and public IP address. It also attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and create a reverse SSH tunnel.

The malware tried to preserve access through a macOS LaunchAgent or a Windows scheduled task, with a startup-script fallback on Windows. Background processes reportedly retried the tunnel about every 60 seconds. The extension could run with the permissions available to Cursor’s integrated development environment, giving the code potential access to local files, source code, and developer tooling.

Why the risk remains serious

Some implementation errors prevented the backdoor from working in certain Windows and macOS scenarios. In particular, the SSH persistence step would generally fail unless Cursor had been started with unusually elevated privileges. However, these flaws do not eliminate the broader risk: the malware still attempted persistence and sent host reconnaissance to the operator.

Phorian said the collection of environment-variable names could help an attacker identify machines likely to contain cloud credentials or API tokens. The report does not establish that such secrets were successfully stolen, but the behavior shows why an infected developer workstation must be treated as a potentially sensitive environment.

Response and recommended checks

Cursor said it worked with the cloud provider hosting the reverse-shell server to prevent infected systems from reaching it. The company removed the malicious release and temporarily closed its VS Code Marketplace to rotate keys, review access controls, and check whether other extensions had been compromised. The marketplace was later reopened.

Users who installed or updated the extension between 5:27 a.m. and 4:35 p.m. Eastern Time on Thursday should consider themselves affected. Anyone who installed it recently should also investigate. Checks should include the installed extension version, SSH authorized keys, launch agents, scheduled tasks, unusual outbound connections, and signs of access to cloud credentials or API tokens. Cursor and Phorian have published indicators of compromise for deeper analysis.

The incident highlights a wider issue for AI coding tools. Trust in a verified publisher does not replace release monitoring, version pinning, least-privilege execution, and careful control of automatic updates. It also shows that platform operators must protect marketplace accounts and communicate quickly when a trusted distribution channel is breached. Anthropic’s lack of a public customer warning, along with the unresolved account-takeover question, remains a significant gap in the response.

Source: Ars Technica AI