Story
Oct 30, 2026
A Backdoored Claude Extension Put Thousands of Cursor Developers in the Crosshairs
Cursor moved to contain a supply-chain breach that may have reached 5,000 developers, while researchers warn that flaws in the malware did not erase the danger—and that the unanswered question is how an official Anthropic account was compromised.
The malicious Claude Code extension appeared in Cursor’s marketplace at 5:27 a.m. ET on Thursday and remained available until 4:35 p.m.—a window of nearly 12 hours in which as many as 5,000 people may have installed it.1
The package, version 2.1.313, was presented through Anthropic’s official Cursor account, according to independent researcher Kevin Beaumont and Phorian, a security firm. That made the episode a supply-chain compromise rather than a routine malicious upload: the attacker had apparently reached a trusted distribution channel. “The malicious version 2.1.313 was posted to the official Anthropic account,” Phorian CTO Luke Roberts said, adding that Cursor extensions auto-update by default unless users change the setting.2
Once installed, the altered extension collected reconnaissance data including hostnames, usernames, operating-system details, home-directory paths, public IP addresses and Git configuration. It also tried to add an attacker-controlled SSH key, activate the local SSH service and open a reverse SSH tunnel. The code targeted Windows, macOS and Linux, potentially giving it access to local files, source code and developer tools through Cursor’s own permissions.2
There was a mitigating wrinkle: coding errors meant the persistence attempt would often fail unless Cursor had been launched with elevated privileges. But Phorian’s assessment was blunt: “the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator.”2
Cursor removed the extension, blocked further distribution, worked with the relevant cloud provider to cut infected machines off from the attacker’s server, and temporarily shut its VS Code Marketplace to rotate keys and audit access. It later said it had verified that “no other extensions were tampered with.”1
What remains unresolved is the breach itself. Neither Cursor nor Anthropic had explained how control of the official account was obtained, and Anthropic had not publicly warned customers, leaving affected developers to determine their own exposure.2