A supply-chain attack has reached the innermost circle of the AI coding world. Cursor, the popular AI code editor, disclosed that a tampered build of Anthropic's official Claude Code extension sat in its own extension marketplace for roughly eleven hours on October 29, installing a persistent SSH backdoor on developer machines before anyone caught it.
According to Cursor's incident notice, the malicious version - Anthropic.claude-code 2.1.313 - was available from about 2:27 a.m. to 1:35 p.m. Pacific time, a window of approximately eleven hours. The company says at most 5,000 users installed the compromised build. The backdoor targeted all three major desktop platforms: macOS, Linux and Windows.
Security researchers who dissected the package found it collected system information and attempted to establish persistent remote access by modifying the machine's SSH configuration. On macOS, a bug in the attacker's logic prevented the implant from fully enabling Remote Login, which likely blunted the blast radius on Apple machines. Crucially, researchers warn that simply uninstalling the extension does not remove what it planted on the host.
Cursor's response was unusually aggressive for an extension marketplace incident. The company pulled the version, took the entire marketplace offline, audited access logs, rotated its keys, rebuilt the marketplace infrastructure from scratch, and brought it back online. Working with the hosting provider, it also took down the attacker's command server, which is now dead. What remains unclear is how the tampered build got into the marketplace in the first place - Cursor's notice does not say, and The Hacker News reports the infection method is still under investigation.
The community response has been fast. An independent researcher going by cookieengineer released check-claude-code-exfil, a read-only indicator-of-compromise scanner that checks hosts, SSH keys, persistence mechanisms, running processes and live connections across the extension directories of VS Code, Cursor, Windsurf, VSCodium and several other VS Code forks. Kevin Beaumont, writing on DoublePulsar, framed the event bluntly: a remote access trojan was delivered through Anthropic's official extension supply chain, against an install base he estimates in the tens of millions of developer machines - a researcher estimate, not a confirmed figure, since the confirmed impacted set remains Cursor's 5,000 at most.
The episode lands on top of an uncomfortable pattern. Earlier this year, a credential stealer shipped through LiteLLM, a widely used open-source AI gateway. Now the attack surface has moved closer to the developer: the marketplace layer through which trusted AI coding tools update themselves. Claude Code is Anthropic's terminal-based coding agent, and its extension in editors like Cursor inherits the trust of both brands - which is precisely what made the tampered build so dangerous.
For developers, the practical checklist is short: if you installed Claude Code 2.1.313 from Cursor's marketplace on October 29, run an IoC scan, rotate SSH keys and credentials, and treat the machine's persistence layer as suspect even after removing the extension. For the industry, the lesson is harder to swallow. As AI coding agents become the most privileged software on a developer's machine - holding source code, tokens and cloud credentials - the registries that distribute them have quietly become some of the highest-value targets on the internet.
Comments (0)
Log in to join the discussion
Log InNo comments yet