The Cursor marketplace hosted a VS Code extension published by Anthropic that was compromised for nearly twelve hours. The malicious build, identified as version 2.1.313, was made available through Anthropic’s verified account and was automatically fetched by up to five thousand developers who either installed it manually or received an auto-update. The extension remained in circulation until a clean release, version 2.1.314, was pushed several hours later.
Neither Cursor nor Anthropic have disclosed how the attackers obtained control of the official distribution channel. Independent researcher Kevin Beaumont and Phorian’s chief technology officer Luke Roberts both confirmed that the compromised package originated from Anthropic’s own account on the platform. Roberts described the incident as a supply-chain compromise in which the adversary leveraged the trusted publishing path, noting that extensions auto-update by default but can be disabled in user settings.
Cursor’s analysis indicated that the malicious extension attempted to install a persistent SSH backdoor by injecting an attacker-controlled key, enabling the local SSH daemon and opening a reverse tunnel to a remote server. The code was crafted to operate on Windows, macOS and Linux environments, and because Cursor extensions inherit the IDE’s permissions, the payload could read local files, source code and interact with developer tooling once executed.
Phorian reported that the backdoor also harvested variable names from the compromised host, allowing the operator to inventory stored cloud credentials and API tokens. This information could be used to prioritize specific machines for subsequent attacks, extending the impact beyond the initial developer workstation. The ability to enumerate such secrets underscores the elevated risk posed by supply-chain compromises that target development tools.
After detecting the malicious version, Cursor collaborated with the cloud provider that hosted the reverse-shell endpoint to block further connections from infected devices. The compromised package was removed from the marketplace, distribution was halted, and the VS Code Marketplace was temporarily shut down to rotate keys, audit access controls and verify that no additional extensions were affected. The marketplace has since been reopened following these remediation steps.
Both Anthropic and Cursor have declined to provide a public explanation for the breach, and Anthropic has not issued a direct warning to its users. The companies advise anyone who installed or updated the extension between 5:27 am and 4:35 pm ET on the affected Thursday to assume compromise and to review the indicators of compromise published by Cursor and Phorian, which include specific IP addresses and cryptographic hashes.