Anthropic Denies System Breach in Claude Code Extension Incident
Malicious code targeting Cursor users exploited marketplace access without compromising Anthropic's internal infrastructure.
1Marketplace Incident Overview
Anthropic officially denied that its internal systems were compromised following the discovery of a malicious Claude Code extension on Cursor’s marketplace. Technical staff member Felix Rieseberg confirmed that the tampered version was not built or published by Anthropic. The incident specifically impacted Cursor users who downloaded the compromised package during the active window.
2Timeline and Scope
The malicious extension, identified as version 2.1.313, remained available for approximately eleven hours on Thursday. It was active between 0227 and 1335 PT, affecting up to 5,000 developers. EDR vendor Phorion first identified the threat, which contained a persistent SSH backdoor designed to function across Windows, macOS, and Linux operating systems simultaneously.
3Data Exfiltration Mechanics
The implant was engineered to harvest sensitive host information, including usernames, configured Git emails, and public IP addresses. Beyond data collection, the script attempted to establish a reverse SSH tunnel to an attacker-controlled server. While the tunnel required administrative privileges that often failed, the extension successfully dropped SSH keys and established persistence mechanisms.
4Cursor's Remediation Steps
Upon detection, Cursor immediately removed the malicious version and halted further distribution to protect its user base. The company performed a full shutdown of the VSCode Marketplace as a precautionary measure. Furthermore, Cursor conducted comprehensive checks to ensure no other extensions were compromised and rotated its internal keys before restoring marketplace services.
5Persistence and Removal
Simply updating to the latest version of the extension is insufficient to remove the threat. Because the malicious package installs a persistence mechanism, developers must actively engage in threat hunting to ensure their instances are clean. Cursor has provided specific remediation scripts and detailed instructions to help users wipe the infection from their machines.
6Attribution and Access
Neither Anthropic nor Cursor has provided a detailed explanation regarding how the malicious actor gained the necessary access to upload the tampered file to the official marketplace. Anthropic maintains that the breach was isolated to Cursor’s platform. The investigation continues as both companies work to secure the distribution channel against future unauthorized uploads.
7Operational Impact Analysis
The incident highlights the inherent risks within third-party extension marketplaces where developers rely on trusted names. By masquerading as an official Claude Code tool, the attacker leveraged brand trust to bypass standard user caution. This event serves as a critical reminder for engineering teams to audit their development environments and installed plugins regularly.
8Supply Chain Security Lessons
Software supply chain attacks remain a potent threat, even when primary vendors maintain secure internal infrastructure. The ability of an attacker to inject code into a marketplace demonstrates the vulnerability of centralized distribution platforms. Organizations must prioritize endpoint security and implement strict monitoring to detect unauthorized SSH tunnels or persistent background processes.