Supply Chain Attack: Anthropic Extension Backdoored for 12 Hours

A backdoored version of Anthropic’s official Claude extension for the Cursor code editor remained live for nearly 12 hours, exposing up to 5,000 developer machines to potential intrusion. The compromised package, version 2.1.313, was distributed through Anthropic’s official account on the Cursor marketplace. Anthropic has not yet issued a public warning to affected customers.

Security researchers confirmed the malicious code was posted by the official Anthropic account, effectively replacing the previous clean version. Independent researcher Kevin Beaumont noted that Anthropic released a patched version, 2.1.314, several hours after the flawed update appeared. Luke Roberts, CTO and co-founder of security firm Phorian, stated that the attacker gained access to the official distribution channel in what he described as a supply chain compromise. Extensions in Cursor auto update by default, meaning many systems likely installed the bad version without user intervention.

Cursor explained that the injected code attempted to establish a persistent SSH backdoor. The script added an attacker controlled SSH key, enabled the local SSH service, and opened a reverse tunnel. The code was designed to function across Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the Integrated Development Environment, the backdoored version could access local files, source code, and other developer tools once installed.

Neither Anthropic nor Cursor has explained how the attackers gained control of the official account. Phorian noted that users can configure settings to prevent auto updates, though the default behavior facilitates automatic installation. The incident highlights the risk associated with third party code running within developer environments that hold access to sensitive project data and credentials.