The Claude VS Code extension backdoor attack put up to 5,000 Cursor users at risk through an official Anthropic distribution account. The malicious extension attempted to create persistent remote access and collect device information. Developers who received version 2.1.313 should treat their machines as potentially compromised, not simply update and move on.

Key takeaways

• Cursor said the malicious extension version, 2.1.313, affected at most 5,000 users.
• Researchers said attackers distributed the compromised package through Anthropic’s official account on Cursor.
• Cursor removed the malicious version and worked with its hosting provider to block access to the attack server.
• At the time of reporting, Anthropic had not publicly warned customers about the incident.

What happened in the Claude VS Code extension backdoor attack?

Attackers placed a malicious version of Anthropic’s VS Code extension in Cursor’s extension marketplace through an official distribution account.

Independent researcher Kevin Beaumont and Phorian CTO and co-founder Luke Roberts both identified Anthropic’s official account as the source of version 2.1.313. Roberts described the incident to Ars Technica as a supply-chain compromise: the attacker gained access to a trusted channel that developers already used.

The malicious release replaced version 2.1.312. Cursor enables extension updates by default, although users can change that setting. That means some developers may have received the backdoor without choosing to download a new release.

According to Beaumont, Anthropic pushed version 2.1.314 several hours later. However, neither Anthropic nor Cursor had explained how attackers gained control of the distribution account when the report appeared.

Which developers should consider themselves affected?

Developers who installed or updated the extension through Cursor during the reported Thursday window should consider their machines potentially affected.

The source identifies that window as 5:27 am ET to 4:35 pm on Thursday. It also advises caution for anyone who recently installed or updated the extension through that channel, even if they cannot confirm the exact time.

Cursor’s figure of “at most 5,000 users” describes the possible reach of the malicious release. It does not establish that attackers successfully gained remote access to every machine.

The report concerns distribution through Cursor’s marketplace. It does not establish that every Claude integration, every VS Code user, or every Anthropic customer received the malicious package.

For a development team, the key questions are which machines received version 2.1.313 and what those machines could access.

What could the malicious extension do?

The extension collected host information and attempted to establish a persistent SSH backdoor on Windows, macOS, and Linux.

Cursor extensions run with the permissions available to the development environment. As a result, the malicious package likely could access local files, source code, and developer tools available to that account.

Device information and credential clues

Cursor said the malware collected the hostname, username, operating system, architecture, home directory path, working directories, configured Git email, and public IP address. It also collected environment variable names.

That last detail matters because variable names can reveal which cloud services and API tokens a developer uses. Phorian said this information could help attackers choose machines for follow-up attacks.

However, collecting variable names is not the same as collecting their stored values. The reported behavior supports concern about credential targeting, but it does not prove that every exposed token or cloud credential was stolen.

Remote access and persistence attempts

The malware attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. This tunnel was intended to give the attacker a route back into the machine.

• On macOS, the code attempted to keep the tunnel running through a LaunchAgent.
• On Windows, it attempted a scheduled task running as SYSTEM, with a Startup-script fallback.
• Background scripts retried the tunnel roughly every 60 seconds.
• The malware reported host details and backdoor status through HTTP POST requests to /beacon on port 8099.

Cursor said coding errors would normally prevent the SSH setup step from succeeding unless Cursor ran with administrator privileges. Phorian nevertheless warned that the malware remained a significant threat because it installed persistence and sent reconnaissance data to the operator.

How should developers respond to a possible infection?

Developers should verify their exposure, preserve evidence, and check for changes beyond the extension itself.

The following are practical defensive recommendations based on the reported behavior, not a published Anthropic cleanup procedure. The Claude VS Code extension backdoor attack involved attempted persistence, so replacing the extension alone should not be treated as proof that a machine is clean.

Check installation and update records

Look for evidence that version 2.1.313 was installed. Review available extension records and update history, rather than relying only on the version currently displayed. A later update may have replaced the malicious package without resolving every change it attempted.

On a work device, contact your security team before deleting files or making major changes. Preserve relevant logs and installation details for investigation.

Review the reported persistence locations

Check SSH authorized_keys entries, SSH service settings, macOS LaunchAgents, Windows scheduled tasks, and Startup scripts for unexplained changes. Pay attention to unexpected SSH processes and repeated outbound connections.

Cursor and Phorian published indicators of compromise, including IP addresses and file hashes. Use those indicators to guide checks rather than assuming that every SSH connection or scheduled task is malicious.

Assess access to company systems

Inventory the repositories, cloud accounts, and developer credentials accessible from the affected device. Where exposure is plausible, consider revoking or rotating relevant secrets from a trusted machine and reviewing account activity.

Do not assume that credential theft occurred, but do not dismiss the risk because the backdoor had bugs. A failed remote-access attempt does not rule out successful information collection.

What did Cursor do to contain the incident?

Cursor removed the malicious version, blocked further distribution, and worked with the attack server’s cloud provider to cut off infected devices’ access.

The company also temporarily shut down its VSCode Marketplace to rotate keys, audit access controls, and check whether other extensions had been compromised. The marketplace later reopened.

These actions addressed distribution and the known server connection. They do not, by themselves, confirm that every affected device was cleaned.

At the time of reporting, Anthropic had not issued a public customer warning. Neither company answered questions about the missing warning or how the supply-chain compromise happened, leaving developers without a full account of the breach.

Our take

This incident shows why an official extension account cannot, by itself, guarantee a safe update. The critical change from version 2.1.312 to 2.1.313 was that a trusted update channel delivered malicious code, rather than merely offering a suspicious third-party package.

The direct concern is for developers who received that release and companies whose code or credentials were accessible from their machines. Readers in Germany and the EU should apply the same exposure check; the report gives no regional breakdown. It also provides no evidence that ordinary Claude chat consumers were affected.

One unresolved question is whether affected organizations have enough update history to identify machines that briefly ran the malicious version. A currently updated extension may not answer that question.

In the coming weeks, watch for a root-cause explanation, direct customer notification, and clearer cleanup guidance. The bugs reduced some backdoor capabilities, but they do not justify treating the incident as harmless.

The Claude VS Code extension backdoor attack means affected developers need to check both their extension history and their machines. Confirm exposure, investigate persistence, and assess accessible credentials instead of treating a newer version as the end of the incident.

(Source: https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/)

For more news: Click Here

FAQ