If anyone on your team uses Cursor, a tampered version of a trusted AI coding extension may have put a backdoor on their machine, and installing the latest version will not remove it. Developer laptops hold source code, credentials and cloud access, so the extension marketplace that feeds them is part of your attack surface.
What happened
The Register reports that an unknown party pushed a tampered update of the Claude Code extension to Cursor’s marketplace. The endpoint security vendor Phorion spotted it first. The package, version 2.1.313, carried a persistent SSH backdoor built for Windows, macOS and Linux. Cursor says users could download it for about 11 hours on Thursday. The Register says it infected up to 5,000 developers, a figure that comes from the allegations it relays and is not clearly confirmed.
The implant gathered usernames, configured Git emails and public IP addresses, and tried to open a reverse SSH tunnel back to the attacker. Cursor and Phorion both found a flaw: the tunnel script needed admin rights on macOS and Windows, which most victims lacked, so it usually failed. The extension still sent the collected data to the attacker, dropped the attacker’s SSH key and installed a persistence mechanism.
Anthropic denies that attackers compromised its systems or employee laptops. Felix Rieseberg, a member of its technical staff, said a malicious actor used access to Cursor’s marketplace to publish a copy Anthropic did not build, and that the versions on its official channels are not affected. Cursor says it removed the package, shut down the marketplace as a precaution, checked other extensions for similar tampering, rotated its own keys and worked with a cloud hosting provider to block the connection to the attacker’s server.
Neither company has explained how the package reached the marketplace. Separately, an Ars Technica report says it is still unknown how attackers got access to Anthropic’s verified Cursor account. That report concerns the account, and The Register’s account of the incident does not say which route the attacker took.
Why it matters
Until the cause is known, teams cannot tell which control failed. If attackers did get into a verified publisher account, the usual advice to install only from the official publisher would offer less protection than many teams assume. That remains an open question, not a finding.
The incident also shows the split in responsibility for AI coding tools. A model vendor builds the extension, while a separate IDE vendor runs the distribution channel. When something goes wrong, customers may struggle to learn who is accountable. Anthropic’s statement is clear about its own systems and leaves the marketplace question to Cursor.
The stolen details, such as Git emails and IP addresses, could help with follow-up targeting, so even failed tunnels may leave some residual risk. This echoes the lesson of our earlier piece on concentrated vendor risk: a single trusted supplier can become the path into many organisations.
What it means for you
- Find exposure. Ask every Cursor user whether they installed or updated the Claude Code extension on Thursday, and check extension version history for 2.1.313.
- Clean, do not just update. Follow Cursor’s remediation guidance and cleanup scripts, because the latest version does not clear the persistence. Look for unfamiliar SSH keys and startup entries.
- Treat admin-level machines as higher risk. The tunnel needed elevated rights, so developers who run with admin privileges deserve priority in your hunt.
- Rotate secrets where in doubt. If a machine shows signs of compromise, replace the credentials and tokens it held.
- Tighten policy. Consider an extension allowlist, delayed updates and logging of IDE extension installs. Ask your vendors how they protect publisher accounts and how fast they notify customers.
If you are comparing AI coding tools, add distribution security to the checklist next to price and features. Our AI Tool Radar tracks pricing, but marketplace controls need a direct question to the vendor.
What to watch
- A root-cause explanation from Cursor or Anthropic on how the attacker got marketplace or publisher access.
- Any evidence that attackers used the stolen host data in follow-on attacks.
- Changes to publisher verification, signing or staged rollouts in Cursor’s marketplace.
- Whether other IDE marketplaces announce similar checks on their AI extensions.
