Anthropic VS Code extension on Cursor backdoored for nearly 12 hours

A malicious version of Anthropic’s Claude VS Code extension was published on Cursor’s marketplace for nearly 12 hours, potentially compromising up to 5,000 developers’ machines. The incident highlights how a single supply‑chain breach can give attackers persistent access to source code, cloud credentials and local files.

What happened and why it matters

According to Ars Technica, the compromised package was version 2.1.313 of the official Anthropic extension for VS Code, distributed through Cursor’s extension marketplace. Within hours the malicious build was replaced by a clean version (2.1.314), but not before the backdoor had been installed on any system that downloaded or auto‑updated the extension during the window. Because Cursor auto‑updates extensions by default, many developers may have received the malicious code without any manual interaction.

How the attackers gained control of the distribution channel

The breach is described as a classic supply‑chain compromise: an adversary obtained credentials for Anthropic’s verified account on the Cursor marketplace and uploaded the malicious version, effectively superseding the legitimate 2.1.312 release. Neither Anthropic nor Cursor have explained how the account was taken over, and Anthropic has not issued a public warning to its customers. Security firm Phorian’s CTO Luke Roberts confirmed that the malicious package was posted from the official Anthropic account, meaning the attackers bypassed any review process that might have caught the code.

What the backdoor is designed to do

Cursor’s analysis of the malicious extension revealed several capabilities:

• Host reconnaissance – The code collects hostname, username, OS, architecture, home‑directory path, environment variable names, working directories, configured Git email and public IP address.
• SSH key injection – It attempts to write an attacker‑controlled SSH public key into the user’s authorized_keys file, enable the local SSH daemon and open a reverse tunnel to a remote server.
• Persistence mechanisms – On macOS the malware creates a LaunchAgent; on Windows it schedules a task that runs as SYSTEM with a fallback startup script. The tunnel‑establishment script retries roughly every 60 seconds.
• Beaconing – Collected host details and backdoor status are posted via HTTP POST to /beacon on port 8099.

Phorian notes that the theft of environment‑variable names can give the operator a quick inventory of stored cloud credentials and API tokens, allowing them to prioritize follow‑up attacks. Bugs in the Windows and macOS payloads prevented the SSH tunnel from succeeding in some cases, but the persistence and data‑exfiltration components remain a serious threat.

Who is affected and what indicators of compromise exist

The compromised extension was available between 5:27 am ET and 4:35 pm ET on Thursday, a window that could have reached as many as 5,000 developers. Cursor advises anyone who installed or updated the extension during that period to assume infection. Indicators of compromise (IOCs) published by Cursor and Phorian include:

• The malicious package’s SHA‑256 hash (provided in the advisory).
• The IP address of the command‑and‑control server listening on port 8099.
• Presence of an unexpected SSH public key in ~/.ssh/authorized_keys.
• New LaunchAgent plist files on macOS or scheduled tasks on Windows that repeatedly invoke a reverse‑tunnel script.

Even users who have since installed the clean 2.1.314 version are not automatically cleaned; the backdoor persists unless the malicious files and keys are manually removed.

Immediate steps developers should take to remediate

1. Disable auto‑updates for Cursor extensions until the situation is fully resolved.
2. Uninstall the Anthropic Claude extension from VS Code, then reinstall the clean 2.1.314 version.
3. Inspect ~/.ssh/authorized_keys for any unfamiliar keys and delete them.
4. Check for newly created LaunchAgents (~/Library/LaunchAgents/) on macOS and scheduled tasks (schtasks /query) on Windows that reference unknown scripts.
5. Monitor network traffic for outbound connections to the reported C2 IP on port 8099.
6. Rotate any cloud credentials or API tokens that may have been exposed, especially those stored in environment variables.
7. Run a full malware scan with an up‑to‑date antivirus solution to catch any residual components.

Cursor has already taken steps to shut down the VS Code Marketplace temporarily, rotate its signing keys and audit access controls. The marketplace is now open again, but developers should remain vigilant.

What this incident means for AI‑powered development tools

The attack demonstrates that AI‑enhanced developer utilities are now part of the broader software supply chain and inherit the same risk profile as traditional libraries and packages. As AI models become more tightly integrated into IDEs—providing code suggestions, documentation generation and even autonomous debugging—the trust placed in the distribution channels grows. A single compromised extension can grant an adversary the same level of access as the developer, including source‑code repositories, secrets and build pipelines.

Security experts recommend adopting a defense‑in‑depth approach: code signing verification, reproducible builds, and strict least‑privilege policies for any tool that runs inside an IDE. Organizations should also consider isolating AI extensions in sandboxed environments or containers, limiting their file‑system and network permissions.

How Grafy users can investigate and protect against similar threats

Grafy provides several tools that can help creators, developers and researchers analyze a suspicious extension or audit their own AI‑assisted workflows:

• Grafy Code ([/code]) lets you load the extension’s source files, run static analysis, and experiment with sandboxed execution to see exactly what system calls are made.
• Grafy Reader ([/reader]) can ingest security advisories, CVE reports or the full Ars Technica article and let you ask follow‑up questions in natural language, extracting the most relevant remediation steps.
• For those who want a broader view of how this incident fits into the evolving landscape of AI‑tool supply‑chain risks, the Grafy News archive includes a related piece, Claude Code VS Code Extension Found with Persistent SSH Backdoor ([/news/claude-code-vs-code-extension-found-with-persistent-ssh-backdoor]), which walks through the technical details of the malicious payload.

By combining code‑level inspection with AI‑driven research assistance, Grafy users can more quickly identify malicious patterns, verify the integrity of third‑party extensions, and keep their development environments secure.

Frequently asked questions

Did Anthropic knowingly distribute the malicious extension?

No. According to the Ars Technica report, the malicious version was uploaded from Anthropic’s verified account on Cursor after attackers gained unauthorized access. Anthropic has not issued a public notice and has not confirmed any intentional involvement.

How long was the backdoor active on infected machines?

The compromised version (2.1.313) was available for roughly 12 hours, from 5:27 am ET to 4:35 pm ET on the day of the incident. However, persistence mechanisms could keep the backdoor active indefinitely until manually removed.

Can I rely on the clean version (2.1.314) to remove the infection?

Installing the clean version does not automatically delete the malicious files, SSH keys or scheduled tasks that were already created. You must manually audit and clean your system, following the remediation steps outlined above.

---

Source: Ars Technica — Anthropic VS code extension on Cursor backdoored for nearly 12 hours