The official extension for the Claude AI model by Anthropic suffered a security breach that planted malicious software containing a backdoor, threatening the devices of up to 5,000 developers for nearly 12 hours, according to multiple reports released on Friday.
The compromised version carried the number 2.1.313 and was signed and distributed via Anthropic's official account on the extension marketplace for the AI-assisted development platform Cursor, targeting developers who downloaded the update automatically or manually. Phorian Security and independent researcher Kevin Beaumont explained that the malicious update temporarily replaced the previous version before Anthropic pushed the secure version 2.1.314 several hours after the rigged release appeared.
What actually happened and what are the capabilities of the backdoor?
The Cursor platform confirmed that the malicious software attempted to install a persistent SSH backdoor by adding a control key owned by the attacker, enabling the local SSH service, and opening a reverse SSH tunnel. Based on the permissions enjoyed by development environment extensions, the compromised version could access local files, source code, and developer tools.
The technical capabilities observed in the malicious code included the following:
- Collecting host and user information, such as hostname, operating system, root path, environment variables, working directories, and public IP address.
- Attempting to add an SSH key and open a reverse tunnel communicating via a specific port with external servers approximately every 60 seconds.
- Stealing local environment variable names, allowing attackers to identify cloud credentials and API access tokens stored on the compromised device.
Despite bugs in the malicious code on Windows and Mac systems that hindered the backdoor in some cases, security authorities considered the threat severe due to the software's ability to gather reconnaissance and transmit it to the operator.
Response and Remediation Measures
The Cursor team worked with the cloud provider hosting the server used for the reverse connection to cut off access to infected devices. The company also removed the compromised version and temporarily shut down the VS Code extension marketplace to execute access key rotations and review security controls. Conversely, Anthropic has not yet issued a direct public warning to customers about the incident, and neither company has provided an official explanation of how attackers managed to hijack the official account.
What does this mean for developers and users?
Any developer who installed or updated the Anthropic extension via Cursor between the morning and evening of last Thursday is considered potentially impacted by the incident. Security authorities recommend checking published indicators of compromise and reviewing the security of keys and cloud access tokens stored on affected devices.