A malicious version of Anthropic's official Claude Code extension for VS Code was distributed through the Cursor marketplace and silently auto-updated onto developer machines, installing a persistent SSH backdoor and reverse-tunnel remote access trojan, according to Kevin Beaumont's writeup on DoublePulsar. Cursor says around 5,000 developer systems were impacted, per Beaumont's report.
The compromised package was version 2.1.313 of the Claude Code extension, uploaded under Anthropic's verified publisher account on the Cursor marketplace, Beaumont writes. Because the extension auto-updated inside Cursor, developers who already had Claude Code installed received the malicious build without any action on their part. Beaumont credits Phorion with first noticing the malicious activity on endpoints, pointing to Phorion's own security advisory as the initial detection.
Cursor's own security notice, quoted in Beaumont's piece, describes what the extension did once installed: it collected hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP address. It then attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel, with persistence set up via a LaunchAgent on macOS or a scheduled task attempting to run as SYSTEM, with a Startup-script fallback, on Windows. Host details and backdoor status were reported back over HTTP POST to a /beacon endpoint on port 8099.
Cursor's notice, as cited by Beaumont, also states that "outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail" — meaning the SSH-key and tunnel installation largely did not succeed on ordinary developer setups. Where it did run, the background scripts retried the tunnel roughly every 60 seconds, according to the notice.
Anthropic replaced the compromised build with version 2.1.314 roughly eight hours after the malicious release, Beaumont reports, and the update appears to remove the backdoor code from the extension itself. It does not undo the SSH backdoor or prior reconnaissance on systems that were already infected, and Beaumont notes Anthropic has not informed customers directly; the malicious version was pulled from OpenVSX, the Visual Studio Marketplace and Cursor without public notice, per the post.
Beaumont pushes back on language in Cursor's own blog post, which states "this malicious version of the extension was not developed by Anthropic." He argues the phrasing understates the incident, since the package was uploaded through Anthropic's verified account rather than through some unrelated channel — "of course Anthropic didn't develop the backdoor, there was a security incident leading to a supply chain attack," he writes. Beaumont's post also names Binance among the "thousands" of organizations running Claude Code and Cursor on developer laptops.
For teams running AI coding-assistant extensions, the actionable detail is in Cursor's own notice: a verified-publisher badge did not stop a trojaned build from reaching production developer machines through auto-update, and the backdoor's installation step only failed because of bugs in the attacker's code, not because of any platform safeguard. Pin extension versions instead of trusting auto-update, and treat IDE extension marketplaces — even ones tied to a trusted publisher account — as an unverified supply-chain surface worth sandboxing or network-isolating developer laptops from.