Malicious Claude Code Update Put Up to 5,000 Cursor Users at Risk
Malicious Claude Code Update Put Up to 5,000 Cursor Users at Risk
The compromised extension appeared in Cursor’s marketplace at 5:27 a.m. ET on Thursday and remained available until 4:35 p.m. The altered package gathered machine details including hostnames, usernames, operating systems, home-directory paths and public IP addresses. Cursor later removed it and said it had verified that “no other extensions were tampered with.”
The scale was potentially significant: version 2.1.313 of Anthropic’s Claude extension may have reached as many as 5,000 users, including through Cursor’s default auto-update behavior. Researchers said the malicious build was posted through Anthropic’s official Cursor account, replacing version 2.1.312; Anthropic released version 2.1.314 several hours later.
The code went beyond simple reconnaissance. According to Cursor, it attempted to add an attacker-controlled SSH key, enable the local SSH service and establish a reverse SSH tunnel across Windows, macOS and Linux. It also tried to make that access persistent and repeatedly reported system details to an operator-controlled server.
Cursor’s account offers some reassurance: it worked with the hosting provider to cut off infected machines from the server, pulled the extension, halted the marketplace to rotate keys and audit controls, then reopened it. But the incident’s central question remains unresolved: neither Cursor nor Anthropic explained how attackers gained access to the official distribution channel.
Security firm Phorian framed the episode more starkly. “It was a supply-chain compromise where the attacker gained access to the official distribution channel,” co-founder Luke Roberts said. Even with coding errors that could make the backdoor fail in some cases, Phorian warned that the malware remained “a significant threat” because it installed persistence and sent host reconnaissance back to its operator.
Write a comment