Cursor, a provider of AI-assisted developer tools, reported that its marketplace hosted a compromised Anthropic VS Code extension. The malicious build, identified as version 2.1.313, was available for roughly twelve hours before being superseded by version 2.1.314. Independent researcher Kevin Beaumont estimates that at most 5,000 users downloaded or auto-updated the extension during that window.
Both Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian, confirmed that version 2.1.313 was published through Anthropic’s verified account on Cursor. Roberts described the event as a supply-chain compromise in which the attacker seized the official distribution channel, allowing the malicious package to replace the legitimate 2.1.312 release automatically for users.
Cursor’s analysis indicated that the compromised extension attempted to install a persistent SSH backdoor by adding an attacker-controlled key, enabling the local SSH daemon and opening a reverse tunnel to a remote server. The code was built for Windows, macOS and Linux, and because extensions inherit the IDE’s privileges, the payload could access local files, source code and developer tooling once executed.
Phorian also reported that the backdoor harvested variable names from the compromised environment, allowing the operator to inventory stored cloud credentials and API tokens. This rapid collection of secrets would enable the attacker to prioritize compromised machines for subsequent exploitation, potentially extending the breach beyond the initial developer workstations.
Cursor responded by collaborating with the cloud provider that hosted the reverse-shell server to terminate connectivity for infected devices. The malicious package was removed from the marketplace, and the VS Code Marketplace was temporarily shut down to rotate keys, audit access controls, and verify that no other extensions were compromised before being reopened to the public.
Neither Anthropic nor Cursor have issued a public advisory explaining how the official account was compromised, and Anthropic has not directly warned its customers. Users who installed or updated the extension between 5:27 am ET and 4:35 pm ET on the affected Thursday are advised to treat their systems as potentially infected, with Cursor and Phorian publishing indicators of compromise such as IP addresses and cryptographic hashes.