Account compromise affects thousands
Anthropic’s official Claude model extension for Cursor allowed a malicious version, 2.1.313, to reach as many as 5,000 developers. This supply-chain compromise occurred because attackers gained access to Anthropic’s official account on the Cursor marketplace. Independent researcher Kevin Beaumont reported that Anthropic pushed version 2.1.314 several hours after the malicious version became available. I find it inexcusable that Anthropic has yet to warn customers about this specific incident. Both Beaumont and Phorian CTO Luke Roberts said the malicious version 2.1.313 came from Anthropic’s official account on Cursor. The malicious release reached at most 5,000 users through the official Anthropic account on Cursor after it successfully superseded the previous version, 2.1.312, in the extension marketplace. Users likely received the malicious code because Cursor extensions auto-update by default, though users can configure this in settings. This version 2.1.313 stayed active for nearly 12 hours before Anthropic released the fix. I find it deeply concerning that neither Cursor nor Anthropic has provided an explanation for how the attackers gained control of the official account.
Malicious SSH backdoor details
| Version | Status | Impact |
|---|---|---|
| 2.1.312 | Legitimate | All users |
| 2.1.313 | Malicious | At most 5,000 users |
| 2.1.314 | Patched | All users |
The malicious version 2.1.313 installs a persistent SSH backdoor via an attacker-controlled SSH key, enables the local SSH service, and opens a reverse SSH tunnel on Windows, macOS, and Linux systems. This code enables an attacker to use the added SSH key to access the developer’s machine remotely. The malicious code is designed to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool’s IDE, the backdoored version likely gives attackers access to local files, source code, and developer tooling once a user installs it on their machine. The compromised package reached developers when they downloaded the extension or when their systems automatically fetched the update. Neither Cursor nor Anthropic has explained how the attackers gained control of the official account, and I find the lack of notice for 5,000 developers completely unacceptable.
