Cursor removes backdoored Anthropic Claude code extension

In short: Cursor says a hacked update of Anthropic’s official Claude code extension was available for nearly 12 hours and may have reached up to 5,000 users.

What happened

Cursor, a company that offers AI tools for software developers, said a malicious version of an “extension” for Anthropic’s Claude was posted to its marketplace. An extension is a small add-on that plugs into a coding app, like adding an extra tool to a toolbox.

The bad version was labeled 2.1.313 and appeared to come from Anthropic’s official verified account on Cursor. Cursor said the extension could collect basic computer and user details and try to set up an SSH backdoor. SSH is a common way to remotely log into a computer, like having a spare key for a locked door.

Cursor said the code tried to add an attacker’s SSH key and open a connection back to a server controlled by the attacker. It was written to work on Windows, macOS, and Linux. Cursor also said bugs in the malicious code meant the break-in steps would fail in some cases, but it still sent “check-in” messages with host information.

Anthropic reportedly pushed a new version, 2.1.314, several hours later. Cursor said it removed the malicious extension, blocked further downloads, and worked with the cloud provider to cut off access to the server the malware contacted. Cursor also temporarily shut down its marketplace to rotate keys (replace digital passwords) and check if anything else was affected.

Why it matters

Tools like coding extensions often have access to a developer’s files and projects. If one is tampered with, it can act like a poisoned software update and expose source code, passwords, and cloud access keys. It is still unknown how attackers got access to Anthropic’s verified Cursor account.

Source: Arstechnica