Anthropic's Claude VS Code Extension Compromised in Supply-Chain Attack

Attackers compromised an official Anthropic extension in the Cursor marketplace, putting up to 5,000 developers at risk of remote system access. The malicious package went live on Friday and remained available for nearly 12 hours before a patched version replaced it—but Anthropic has not yet notified affected users.

How the Attack Unfolded#

The compromised extension, version 2.1.313, was distributed through Anthropic's official account on Cursor's marketplace. Security researchers including Kevin Beaumont and Luke Roberts, CTO of security firm Phorian, identified the breach as a supply-chain attack where threat actors gained unauthorized control of the legitimate distribution channel itself. Anthropic released a clean version (2.1.314) hours later, yet the company has not disclosed how attackers obtained account access.

Because Cursor extensions auto-update by default on user machines, the malicious code may have installed automatically, though users can disable this behavior in settings.

What the Backdoor Does#

The compromised version attempted to establish persistent remote access through several techniques:

• Installing an attacker-controlled SSH key
• Enabling the local SSH service
• Opening a reverse SSH tunnel for remote connections

The cross-platform payload was engineered to function on Windows, macOS, and Linux. Since Cursor extensions operate with full IDE permissions, an infected installation would grant attackers access to local files, source code, and development tools—potentially exposing credentials, proprietary code, and private infrastructure details stored on developer machines.

Outstanding Questions#

Neither Cursor nor Anthropic has explained how the attackers breached the official account or identified which developers were compromised. Phorian's security team published additional technical details on the incident.