In a development that will surprise absolutely no one who has ever muttered "surely the auto-update won't betray me," an official VS Code extension for Anthropic's Claude model was backdoored and threatened as many as 5,000 developers' machines, multiple sources reported Friday. Anthropic, for its part, has so far declined to warn customers about the incident - presumably operating under the time-honored corporate principle that if you don't mention the breach, it's more of a vibe than a crisis.
The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday. The malicious version, 2.1.313, subsequently affected "at most 5,000 users," presumably when they either downloaded it or their systems automatically fetched and installed it - because nothing says "modern software" like a feature that installs your problems for you.
Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic's official account on Cursor. So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account - a detail that feels like it might be worth, say, a blog post.
"It was a supply-chain compromise where the attacker gained access to the official distribution channel," Phorian CTO and co-founder Luke Roberts told Ars. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings." Phorian has more details here - presumably in a document titled "Things You Wish You'd Known Before."
Anthropic has yet to issue public notice of the incident to customers. The company's communications strategy appears to be modeled on the "if a tree falls in a forest" thought experiment, except the tree is a backdoor and the forest is your laptop.
Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux - an admirable commitment to cross-platform compatibility, if nothing else. Because Cursor extensions run with the permissions of the tool's Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed. In other words, it had the run of the place.
Phorion said the theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on a compromised device, likely so it could prioritize which machines to target in follow-up attacks. Efficient! Almost professional. One might even call it "enterprise-grade."
Bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases. Phorion said that despite the coding flaws, "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator." So the attackers were sloppy, but not sloppy enough - a comforting middle ground.
Cursor said company personnel worked with the cloud provider hosting the server the reverse shell connected to so that infected devices could no longer reach it. Personnel also removed the backdoored version from the marketplace and blocked further distribution. The company also shut down the VSCode Marketplace to rotate keys, audit access controls, and confirm no other extensions were compromised. The marketplace is now open - so you can go back to downloading things with the traditional amount of trust.
It remains unclear why Anthropic isn't publicly warning customers of the threat and why it and Cursor aren't explaining how the supply-chain compromise happened. Neither company answered questions seeking this information. In fairness, they may be busy - perhaps drafting a statement, perhaps staring at a wall, perhaps hoping the whole thing blows over by Tuesday.
Anyone who installed or updated Anthropic's VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected, although it may be wise for anyone who has recently done so to also consider themselves potentially infected. Both Cursor and Phorion list various indicators of compromise, including IP addresses and cryptographic hashes. Consider this your gentle reminder that "auto-update" is just Latin for "trust fall."