Anthropic Denies System Breach in Claude Code Extension Incident
Malicious code targeting Cursor users exploited marketplace access without compromising Anthropic internal infrastructure.
1Marketplace Security Incident Overview
A malicious version of the Claude Code extension was uploaded to the Cursor marketplace, impacting approximately 5,000 developers. Anthropic clarified that its own internal systems and employee laptops remained secure throughout the event. The company confirmed it did not build or publish the compromised extension, distancing itself from the marketplace breach.
2Technical Nature of the Backdoor
The malicious update, identified as version 2.1.313, contained a persistent SSH backdoor compatible with Windows, macOS, and Linux. EDR vendor Phorion first detected the threat, noting the script attempted to collect sensitive host data. This included usernames, configured Git emails, and public IP addresses, posing significant risks to affected developer environments.
3Execution and Failure Mechanisms
The implant attempted to establish a reverse SSH tunnel to an attacker-controlled server. Crucially, the script required administrative privileges on macOS and Windows to function fully. In most instances, the lack of these elevated rights caused the tunnel creation to fail, limiting the immediate impact of the malicious code on many machines.
4Persistence and Data Exfiltration
Despite the failed tunnel attempts, the extension successfully forwarded host data to the attacker and installed a persistence mechanism. Simply updating to the latest version does not remove this threat. Developers must actively hunt for the malicious files and follow specific remediation steps provided by Cursor to ensure their systems are clean.
5Cursor Marketplace Response Actions
Cursor removed the malicious version immediately upon detection and blocked further distribution to prevent additional infections. Out of caution, the platform temporarily shut down the VSCode Marketplace. They performed comprehensive checks on other extensions, rotated internal keys, and collaborated with a cloud hosting provider to block connections to the attacker's server.
6Anthropic's Official Stance
Anthropic staff member Felix Rieseberg emphasized that the incident was limited to Cursor’s marketplace environment. The company is actively working with Cursor to investigate the breach. They maintain that the official versions of their tools distributed through verified channels remain unaffected, urging users to rely only on official sources for software.
7Remediation for Affected Developers
Cursor has published detailed instructions on how to wipe the infection from compromised instances. Because the persistence mechanism survives standard updates, users must manually execute removal scripts. Developers are advised to review their SSH configurations and check for unauthorized keys that may have been dropped during the eleven-hour window of exposure.
8Broader Implications for Supply Chains
This incident highlights the inherent risks in third-party marketplace distribution models for developer tools. While Anthropic was not the source of the breach, the event underscores the necessity for rigorous verification of extension updates. Security teams must remain vigilant regarding supply chain integrity, even when using trusted platforms for essential development software.