Ethical Hacking News
Supply-chain attacks are becoming increasingly prevalent, and this latest case of a backdoored extension highlights the risks that developers face when using third-party tools. The malicious extension, 2.1.313, was distributed through Anthropic's official account on Cursor, a maker of AI-assisted developer tools. This compromise affected "at most 5,000 users" and was found to have the capabilities of collecting host and user information, attempting to add an attacker-controlled SSH key to authorized_keys, enabling the local SSH service, and opening a reverse SSH tunnel. The incident serves as a reminder to developers to stay vigilant and take steps to protect themselves from such supply-chain attacks.
Anthropic's Claude model was backdoored with a malicious extension (2.1.313) distributed through Cursor's official account. The compromised package was a VS Code extension available in the marketplace of Cursor, a company that provides AI-assisted developer tools. The malicious extension attempts to install a persistent SSH backdoor using an attacker-controlled SSH key, enabling local SSH service and opening a reverse SSH tunnel. The backdoor collects host and user information, attempts to add an attacker-controlled SSH key to authorized_keys, and enables local SSH service. The companies involved (Anthropic and Cursor) have removed the backdoored version from the marketplace and blocked further distribution, but are not publicly warning customers. Anyone who installed or updated the extension between a specific time frame should consider themselves affected.
The tech world was recently hit with a significant supply-chain compromise when an official extension for Anthropic's Claude model was backdoored. The malicious version, 2.1.313, was distributed through Anthropic's official account on Cursor, a maker of AI-assisted developer tools. This compromise affected "at most 5,000 users," as reported by independent researcher Kevin Beaumont and Phorian's CTO and co-founder Luke Roberts.
The compromised package was a VS Code extension available in the marketplace of Cursor, a company that provides AI-assisted developer tools. The malicious version, 2.1.313, was posted to the official Anthropic account, effectively superseding version 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.
Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool’s Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed.
The capabilities of the backdoor include collecting host and user information, attempting to add an attacker-controlled SSH key to authorized_keys, enabling the local SSH service, and opening a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail. The backdoor also attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.
Reporting host details and backdoor status via HTTP POST to /beacon on port 8099 was another aspect of the malicious extension's capabilities. Phorion said that the theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on a compromised device, likely so it could prioritize which machines to target in follow-up attacks.
Cursor said company personnel worked with the cloud provider hosting the server the reverse shell connected to so that infected devices could no longer reach it. Personnel also removed the backdoored version from the marketplace and blocked further distribution. The company also shut down the VSCode Marketplace to rotate keys, audit access controls, and confirm no other extensions were compromised. The marketplace is now open.
In response to the compromise, it remains unclear why Anthropic isn’t publicly warning customers of the threat and why it and Cursor aren’t explaining how the supply-chain compromise happened. Neither company answered questions seeking this information.
Anyone who installed or updated Anthropic’s VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected, although it may be wise for anyone who has recently done so to also consider themselves potentially infected. Both Cursor and Phorion list various indicators of compromise, including IP addresses and cryptographic hashes.
Related Information:
https://www.ethicalhackingnews.com/articles/Supply-Chain-Compromise-Exposed-Anthropics-VS-Code-Extension-Backdoored-by-Cursor-ehn.shtml
https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/
Published: Fri Oct 30 19:06:30 2026 by llama3.2 3B Q4_K_M
