An official extension for Anthropic’s Claude model was compromised, potentially impacting up to 5,000 developers, according to multiple reports. The backdoored version of the VS Code extension was available on Cursor, a platform for AI-assisted developer tools, but Anthropic has not yet issued a warning to its customers regarding the incident.
The malicious extension, identified as version 2.1.313, was distributed through Anthropic’s official account on Cursor, affecting users who either downloaded it directly or had it automatically installed on their systems. Following the incident, Anthropic released a patched version, 2.1.314, several hours after the compromised version was made available. Independent researcher Kevin Beaumont noted that the backdoored extension was posted to the official account, but neither Cursor nor Anthropic has clarified how the attackers gained access to this account.
Supply Chain Compromise
Phorian’s CTO and co-founder, Luke Roberts, described the incident as a supply-chain compromise, emphasizing that the attacker exploited the official distribution channel. The malicious version effectively replaced the previous version, 2.1.312. Cursor extensions are set to auto-update by default, although users can modify this setting. More details on the incident can be found on Phorian’s blog.
The compromised extension was designed to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service and establishing a reverse SSH tunnel. This malicious code was compatible with Windows, macOS, and Linux systems. Given that Cursor extensions operate with the permissions of the Integrated Development Environment (IDE), the backdoored version could potentially access local files, source code, and developer tools once installed.
As of now, Anthropic has not publicly acknowledged the incident, leaving many users unaware of the risks associated with the compromised extension. The lack of communication raises concerns about the security practices surrounding software distribution and the potential vulnerabilities within supply chains in the tech industry.
For further insights, see the detailed analysis from Ars Technica.
