- A malicious version of the official Anthropic Claude Code extension for VS Code was found in the Cursor marketplace.
- The compromise led to the installation of a persistent SSH backdoor on up to 5,000 developer machines across Windows, macOS, and Linux.
- Anthropic denies its systems were breached, stating an attacker used access to Cursor’s marketplace to publish the tampered copy.
Cybersecurity researchers have reported that the official Anthropic Claude Code extension was compromised on the Open VSX registry and Cursor marketplace, leading to the installation of a persistent SSH backdoor on infected hosts. This incident affected developers using Visual Studio Code across Windows, macOS, and Linux.
Incident Details and Anthropic’s Response
The issue was traced to a compromise within the Cursor Marketplace, prompting the AI coding platform Cursor to temporarily shut down its service to remove the malware. According to Cursor, the malicious version, 2.1.313, was available for download for approximately 11 hours, between 02:27 and 13:35 PT (09:27 and 20:35 UTC) on Thursday. This potentially impacted up to 5,000 users who either downloaded the extension or had their systems automatically update.
Anthropic, the developer behind the Claude AI model, has denied any compromise of its own systems or employee laptops. Felix Rieseberg, a member of Anthropic’s technical staff, clarified that “a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users.”
Attack Mechanism and Potential Impact
First identified by EDR vendor Phorion, the tampered extension contained an SSH backdoor designed to collect host and user information, including usernames, configured Git emails, and public IP addresses. It also attempted to open a reverse SSH tunnel. Analysis revealed a critical flaw: the script required administrator rights on macOS and Windows to establish the SSH tunnel, which were often not present, leading to failure. However, the extension still forwarded collected host and user data to the attacker, dropped the attacker’s SSH key, and installed a persistence mechanism.
Experts emphasize that simply installing the latest version of the extension (2.1.314, pushed by Anthropic hours after the malicious version) is insufficient to clear the persistence mechanism. Developers are urged to actively hunt for threats on their systems to ensure no SSH tunnel can be successfully created.
Cursor responded by immediately removing the malicious version, blocking further distribution, and temporarily shutting down the VSCode Marketplace as a precautionary measure. The company also performed checks to confirm no other extensions were compromised, rotated its internal keys, and collaborated with a cloud hosting provider to block connections to the attacker’s server. Full remediation details and links to removal scripts are available in Cursor’s official advisory.
This incident highlights the supply-chain risks inherent in software ecosystems, particularly with third-party extensions. For more insights into AI and its implications, you might be interested in our article: Walmart to Welcome AI Agents for Automated Shopping Experiences.
| Incident Detail | Description |
|---|---|
| Affected Extension | Anthropic Claude Code for VS Code |
| Malicious Version | 2.1.313 |
| Availability Duration | Approximately 11 hours (02:27 - 13:35 PT) |
| Estimated Users Affected | Up to 5,000 |
| Targeted OS | Windows, macOS, Linux |
| Malware Type | Persistent SSH Backdoor |
| Data Collected | Usernames, Git emails, Public IP addresses |
| SSH Tunnel Requirement | Admin rights (often failed) |
For developers using VS Code and particularly extensions like Claude Code, this incident underscores the critical importance of vigilance when installing and updating third-party components. Even official distribution channels can be compromised. It is recommended to regularly scan systems for anomalies, utilize comprehensive endpoint security solutions, and closely monitor advisories from software vendors. In this specific case, even though the SSH tunnel often failed to establish due to lack of admin rights, user data was still exfiltrated, and the persistence mechanism remained active. This necessitates immediate system cleanup actions beyond simply updating the extension.
This is exactly why I’m always so hesitant to add new extensions, especially from third-party marketplaces. I’ve been using the official Claude Code extension directly from the VS Code Marketplace for months without any issues, and it’s been a game-changer for my workflow. The AI suggestions are incredibly helpful, and it integrates seamlessly. However, I once tried a similar AI helper from a lesser-known source and it caused constant crashes. My tip: always stick to official channels and check reviews before installing anything new. It’s a pain to clean up after a bad install.