Anthropic Official Extension Poisoned: 5,000 Developer Machines Hit by Backdoor

The security myth of AI programming tools has been torn open. According to Ars Technica, Anthropic's official Claude extension for the Cursor platform was compromised in a supply chain attack. The malicious version remained live on the official account for nearly 12 hours, affecting up to 5,000 developer machines. More troubling still, how the attackers gained access to Anthropic's authenticated account remains an unsolved mystery.

The Full Picture: A Textbook Supply Chain Attack

This isn't a case of some knockoff extension written by a random MIT student being tampered with—it's the Claude extension itself, published under Anthropic's official account. The malicious version 2.1.313 was distributed through Anthropic's official account on the Cursor marketplace, then replaced by version 3.1.314. Independent researcher Kevin Beaumont and the co-founder and CTO of security firm Foreo both confirmed this distribution path.

As a fork of VS Code, Cursor has auto-update enabled by default for extensions. This means victims didn't need to click any suspicious links or confirm any pop-ups—the malicious code installed silently in the background. The impact was therefore narrowed to developers who use Cursor and also use the Claude extension, but the number 5,000 carries far more weight than an ordinary attack—these are all machines belonging to professional developers with technical judgment.

Supply Chain Attack refers to an attack where adversaries don't directly target the end goal, but instead infiltrate indirectly by compromising a trusted third party (such as a software vendor, open-source project, or distribution channel). In software distribution scenarios, attackers may tamper with official installers, hijack update servers, or breach developer accounts, allowing malicious code to enter victim systems under the guise of a "legitimate signature" or "official source." Such attacks are extremely stealthy because users typically don't suspect updates from official channels. In recent years, incidents like SolarWinds, Codecov, and 3CX all fall into this category, and this incident demonstrates that the AI tool ecosystem faces the same risk.

Cursor is an AI-first code editor built as a fork of VS Code, inheriting VS Code's extension marketplace mechanism. The extension marketplace allows developers to publish plugins, but once credentials for an official account are leaked, attackers can publish malicious versions. The auto-update mechanism for extensions is enabled by default, meaning users can get the latest version without any interaction—this is both a convenience and a risk.

What the Backdoor Does: From Information Gathering to Persistent Control

The list of malicious behaviors disclosed by Cursor reads like an intrusion manual. The extension collects hostname, username, operating system, architecture, home directory path, environment variable names, working directory, configured git email, and public IP, and sends them via HTTP POST to a beacon on port 8099.

The theft of environment variable names is particularly alarming. According to Foreo's analysis, attackers can use this to quickly inventory the cloud credentials and API tokens stored on infected devices, thereby determining the priority of subsequent attacks. In other words, the first wave of infection is just reconnaissance—the real harvest may still be coming.

Even more serious is the persistence mechanism. The malicious code attempts to add attacker-controlled SSH keys to authorized_keys, enable the local SSH service, and establish a reverse SSH tunnel. On macOS, persistence is achieved through launch agents; on Windows, through scheduled tasks. The tunnel retries the connection approximately every 60 seconds. The code is written for Windows, macOS, and Linux simultaneously.

Since Cursor extensions run with the IDE's privileges, once the backdoor is installed, it can access local files, source code, and developer tools. Unless Cursor happens to be launched with administrator privileges causing the code to fail, this step will succeed.

authorized_keys is the file in the SSH protocol that stores public keys allowed to log into an account, typically located at ~/.ssh/authorized_keys in the user's home directory. Adding an attacker-controlled public key to it is equivalent to creating a permanent key for the attacker, allowing them to log into the target machine directly via SSH without a password. This is one of the most common persistence backdoor techniques in Unix/Linux systems.

Reverse SSH tunnel is a method where an internal machine actively connects to an external server and establishes a tunnel, often used to bypass firewalls or NAT restrictions. Through a reverse tunnel, attackers can access internal machines from the outside without directly exposing ports. The tunnel retries the connection approximately every 60 seconds, ensuring connection stability.

launch agent is a mechanism in macOS for automatically running programs or scripts when a user logs in, typically stored as plist files in the ~/Library/LaunchAgents directory. Scheduled tasks in Windows are implemented through Task Scheduler, allowing programs to execute automatically at specific times or under trigger conditions. Both are operating-system-level persistence methods, and malicious code uses them to ensure survival after reboots.

The Silence of Two Companies and a Larger Concern

As of the time of reporting, Anthropic has not issued a public warning to customers, and neither Cursor nor Anthropic responded to media inquiries about how the supply chain attack occurred. Such silence is not uncommon in security incidents, but for a company that repeatedly emphasizes AI risk, the contrast is especially striking.

Some argue that Anthropic shouldn't bear all the blame—after all, the complexity of the extension ecosystem is an industry-wide issue. But the opposing view is equally strong: the breach of an official account indicates a gap in the access controls of the publishing pipeline itself. This has nothing to do with the extension ecosystem; it's Anthropic's own security responsibility.

A Warning for AI Agent Deployment

The most intriguing aspect of this incident is the trust chain problem it exposes. Users did nothing, yet the system was compromised on its own. Scale this scenario up to an enterprise environment: if dozens or hundreds of AI Agents are running in your infrastructure, they need to connect to tools, call libraries, and automatically update dependencies. If any one of these links is penetrated by a supply chain attack, the Agent becomes a springboard for attackers with your privilege level and full access.

If Anthropic and Cursor—backed by a large conglomerate—can't secure their own distribution pipelines, why should ordinary enterprises believe they can? The answer to this question is probably more unsettling than the incident itself.

AI Agent refers to an intelligent entity capable of autonomously perceiving its environment, making decisions, and executing actions, typically built on large language models. In enterprise environments, Agents need to call external tools, access APIs, read and write files, and even automatically update dependency libraries. This autonomy brings efficiency but also expands the attack surface: once a component that an Agent depends on is compromised by a supply chain attack, attackers can leverage the Agent's privileges to execute malicious operations. In this incident, the extension ran with IDE privileges, equivalent to gaining local access to the developer. If a similar situation occurred with an Agent, attackers could control the entire automated workflow. Therefore, the trust boundary for AI Agents must include source verification for all their dependencies, not just the Agent itself.

What Developers Should Do

Short-term action items are clear: check the version of the Claude extension in Cursor to confirm whether 2.1.313 was ever installed; review authorized_keys for unfamiliar SSH keys; check launch agents or scheduled tasks for suspicious persistence entries; and rotate cloud credentials and API tokens stored in the environment.

In the long term, this incident serves as a reminder to all teams relying on AI programming tools and Agent frameworks: auto-update is a double-edged sword, and blind trust in official sources is no match for supply chain attacks.

One-line Summary

Anthropic's official Claude extension was poisoned in the Cursor marketplace, and 5,000 developer machines were backdoored.

Paragraph Summary

Anthropic's official Claude extension for the Cursor platform suffered a supply chain attack. The malicious version 2.1.313 was distributed through the official account, remained live for nearly 12 hours, and affected up to 5,000 developer machines. Because Cursor extensions auto-update by default, users could be compromised without any action. The backdoor collects host information, steals environment variables to inventory cloud credentials, and attempts to implant SSH keys for persistent reverse tunnels, with code covering Windows, macOS, and Linux. Anthropic has not publicly warned customers, and how attackers obtained official account access remains unknown. The incident highlights trust chain risks in AI Agent deployment: when official distribution pipelines can't be trusted, automatically updating Agents may become attack springboards.