Malicious Claude Code extension 2.1.313 shipped an SSH backdoor to Cursor developers, about 5,000 systems affected
- Anthropic's Claude Code extension version 2.1.313 reached the Cursor marketplace with code that added an attacker SSH key to authorized_keys and opened a reverse SSH tunnel, and Cursor says at most 5,000 developer systems were affected.
- Cursor's notice says errors in the malicious code meant the SSH steps would fail except in unusual cases where Cursor ran with administrator privileges, so the LaunchAgent or scheduled-task persistence likely never completed.
- Anthropic replaced 2.1.313 with 2.1.314 roughly eight hours after the compromise was reported, and 2.1.313 is gone from Open VSX, the Visual Studio Marketplace and Cursor.
- Kevin Beaumont says the new build does not remove an SSH backdoor from machines already infected, and that Anthropic deleted the malicious version without telling customers.
- Phorion noticed the malicious endpoint activity first, and the extension auto-updated inside Cursor to the bad build; a Binance post cited in the thread says the Open VSX listing is owned by Anthropic employee Igor Kofman.
Hacker News opinions
How legit is this? The post is thin on details. I don't use Cursor, but plenty of people in my org run the VS Code extension, so I'd like to know how worried we should be.
The Binance post someone linked says 2.1.313 hit Open VSX on Oct 30, and Paul McCarty (6mile) flagged it on the OpenSource Malware blog. That wasn't the official build, so just stick to official builds.
Cursor's own security notice is up now, and there's a Binance square post that looks like an official account saying the same thing.
His handle has no link in the post, but the posts are at cyberplace.social/@GossiTheDog.
It wasn't Anthropic that got hacked, it was the Cursor marketplace.
Cursor pulls from Open VSX, which every non-Microsoft VS Code fork uses, so that has nothing to do with Cursor. Anthropic controls the Open VSX publishing account, so I still think Anthropic got popped. The Binance post says the extension is owned by an Anthropic employee, Igor Kofman.
2.1.313 is missing from the official Microsoft marketplace too. That means it was published there and then pulled, which points at Anthropic rather than Cursor.
If the only goal was stealing crypto, staying out of that dumpster fire means you're probably fine. You've still got a reverse shell to clean up, though.
The title is misleading at best. It's a third-party extension version that got backdoored, not Anthropic's own infrastructure, and Cursor puts it at most 5,000 users.
Saying Anthropic was hacked is a stretch. Someone published a modified build to the marketplace, and Cursor's own wording is a lot more careful than the headline.