Cursor says tampered Claude Code extension on its marketplace reached up to 5,000 users
Cursor said a maliciously modified version of Anthropic's Claude Code extension was on its VS Code extension marketplace for about 11 hours on Thursday, affecting at most 5,000 users. How attackers got control of the publishing account is not yet explained.
1 / 2
The story, neutrally told
Mixed · 2Cursor said on Friday that a maliciously modified version of Anthropic's Claude Code extension was available on its Cursor VS Code extension marketplace on Thursday, affecting up to 5,000 users. CNAN “a maliciously modified version of Anthropic’s Claude Code extension was available on its Cursor VS Code extension marketplace on Thursday, affecting up to 5,000 users” Read at CNA ↗ Ars TechnicaLC “affected “at most 5,000 users,”” Read at Ars Technica ↗ Mixed · 2According to Cursor, the malicious version was live from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday (5:27 a.m. to 4:35 p.m. ET), nearly 12 hours. CNAN “from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday” Read at CNA ↗ Ars TechnicaLC “between 5:27 am ET and 4:35 pm on Thursday” Read at Ars Technica ↗ Left · 1Ars Technica identified the malicious build as version 2.1.313. It cited independent researcher Kevin Beaumont as saying Anthropic pushed version 2.1.314 several hours later. Ars TechnicaLC “The malicious version, 2.1.313”“Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor” Read at Ars Technica ↗
Centre · 1Cursor said the extension tried to collect host and user information, including hostname, username, operating system and public IP address, and tried to set up remote access for the attacker. It said a key step would have failed on most machines because it needs administrator rights. CNAN “attempted to collect host and user information such as hostname, username, operating system and public IP address”“a key step would have failed on most machines because it requires administrator rights” Read at CNA ↗ Left · 1Ars Technica reported Cursor's description of the remote access as a persistent SSH backdoor. It uses an added attacker-controlled SSH key, enables the local SSH service and opens a reverse SSH tunnel, with code written for Windows, macOS and Linux. Ars TechnicaLC “attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel” Read at Ars Technica ↗ Left · 1Ars Technica said that, because Cursor extensions run with the permissions of the IDE, the backdoored version would likely gain access to local files, source code and developer tooling. It added that bugs in the Windows and macOS code stopped the backdoor working in some cases, though security firm Phorion called it still a significant threat. Ars TechnicaLC “the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed”“Bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases.” Read at Ars Technica ↗
Centre · 1Cursor said it removed the malicious version, blocked its distribution and shut down the marketplace as a precaution. It then rebuilt the marketplace and brought it back online, saying no other extensions were affected. CNAN “Cursor removed the malicious version and blocked its distribution and shut down the marketplace as a precaution”“the incident did not impact other extensions on its marketplace” Read at CNA ↗ Left · 1Ars Technica added that Cursor worked with the cloud provider hosting the reverse-shell server so infected devices could no longer reach it. It also said the marketplace was shut to rotate keys and audit access controls. Ars TechnicaLC “worked with the cloud provider hosting the server the reverse shell connected to so that infected devices could no longer reach it”“to rotate keys, audit access controls, and confirm no other extensions were compromised” Read at Ars Technica ↗ Mixed · 2The two outlets describe the extension's origin differently. CNA reports Cursor saying the extension was not developed by Anthropic. Ars Technica says Beaumont and Phorian CTO Luke Roberts both said version 2.1.313 was distributed through Anthropic's official Cursor account, which Roberts called a supply-chain compromise of the official distribution channel. CNAN “the extension was not developed by Anthropic” Read at CNA ↗ Ars TechnicaLC “It was a supply-chain compromise where the attacker gained access to the official distribution channel” Read at Ars Technica ↗
Mixed · 2Neither Cursor nor Anthropic has explained how attackers gained control of the account. Ars Technica says Anthropic has not warned customers and that neither company answered its questions, and CNA says Anthropic did not immediately respond to a request for comment. Ars TechnicaLC “neither Cursor nor Anthropic has explained how the attackers gained control of the account” Read at Ars Technica ↗ CNAN “Anthropic did not immediately respond to a request for comment” Read at CNA ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- Security-focused investigation that stresses the supply-chain compromise and the silence of Anthropic and Cursor.
- Emphasis
- Technical detail, outside researchers' views, the unexplained account takeover and Anthropic's lack of public notice.
- Leaves out or plays down
- Does not repeat Cursor's statement that the extension was not developed by Anthropic, or its point that a key step would fail on most machines without administrator rights.
- Charged language
- “backdoored”
- For example
-
“Anthropic so far has yet to warn customers of the incident.” — Ars Technica
“It remains unclear why Anthropic isn’t publicly warning customers of the threat” — Ars Technica
Centre1 outlet
- Framing
- Short, bullet-style report relaying Cursor's account of the incident and its response.
- Emphasis
- Scope (up to 5,000 users), timing, data the extension tried to collect, and Cursor's remediation.
- Leaves out or plays down
- Does not mention version numbers, the SSH backdoor details, the use of Anthropic's official account, or the lack of any warning to customers.
- For example
-
“Cursor said the extension was not developed by Anthropic” — CNA
Right0 outlets
No right outlet in our sources has covered this story yet.
What every side reports
- A malicious version of the Claude Code extension was on Cursor's VS Code marketplace on Thursday.
- Cursor says at most 5,000 users were affected.
- Cursor removed the version, shut the marketplace and reopened it.
- Anthropic had not commented publicly at the time of reporting.
Where accounts differ
-
Whether the extension came from Anthropic's account
- Left
- Ars Technica cites researchers saying version 2.1.313 was posted through Anthropic's official Cursor account, and that how attackers got access is unknown.
- Centre
- CNA relays Cursor saying the extension was not developed by Anthropic.
Cursor organisation
Says a maliciously modified extension, not developed by Anthropic, was live for about 11 hours and affected at most 5,000 users. It says it removed it, blocked distribution, rebuilt the marketplace and found no other extensions affected, but has not said how the account was compromised.
“Upon detection, Cursor removed the malicious version and blocked its distribution” — CNA
“neither Cursor nor Anthropic has explained how the attackers gained control of the account” — Ars Technica
Anthropic organisation
Has not commented publicly. Per Ars Technica, it pushed version 2.1.314 hours after the malicious build and has not warned customers.
“Anthropic did not immediately respond to a request for comment” — CNA
“Anthropic has yet to issue public notice of the incident to customers.” — Ars Technica
Left1 article
-
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Critical Detailed security report that presses Anthropic and Cursor over the unexplained account compromise and missing customer warning.
Centre1 article
-
CNAN ·
Cursor says up to 5,000 users affected by tampered Claude Code extension
Neutral Concise relay of Cursor's statement and remediation steps, noting Anthropic had not responded.
Right0 articles
No coverage yet.
- 30 Oct 08:32 First CNAN Cursor says up to 5,000 users affected by tampered Claude Code extension
- 30 Oct 21:09 +12h 37m Ars TechnicaLC Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…