Anthropic VS Code extension version 2.1.313 on Cursor contained SSH backdoor for 12 hours
A verified Anthropic extension on Cursor was replaced with malicious code that installed SSH backdoors for roughly 12 hours, reaching at most 5,000 users. The event exposes missing account protections and attestation requirements in AI developer tooling marketplaces. No public disclosure has occurred despite clear evidence of credential theft risk to enterprise codebases.
The compromise occurred through Cursor's marketplace when attackers published the malicious package under Anthropic's verified account. Cursor extensions run with full IDE privileges, granting the backdoor access to local files, environment variables, and source repositories on Windows, macOS, and Linux. Auto-update defaults accelerated distribution before Anthropic replaced the package several hours later.
Independent researcher Kevin Beaumont and Phorian CTO Luke Roberts confirmed the package originated from the official account and that the payload opened persistent reverse SSH tunnels. No public incident report or customer notification has been issued by Anthropic or Cursor as of the reporting date. Extension signing and account access logs remain the only documented control points that failed.
This incident follows repeated supply-chain attacks on developer tooling, including the 2024 XZ Utils compromise and PyPI typosquatting campaigns. AI coding extensions amplify risk because they execute with broad workspace permissions and often handle proprietary code. Absence of mandatory two-factor enforcement or reproducible build attestations on Cursor's platform left the distribution channel exposed.
Cursor and Anthropic must publish account-access timelines and extension signing proofs within seven days or face regulatory scrutiny under emerging software supply-chain rules. Enterprises should immediately audit Cursor extension versions and disable auto-update until verified controls are demonstrated.
Anthropic: will publish account compromise timeline and extension signing audit within 72 hours or face SEC disclosure requirement
Sources (2)
- [1]Primary Source(https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/)
- [2]Supporting Source(https://phorian.security/blog/cursor-anthropic-extension-incident-2026)