Anthropic denies link between Claude Code extension compromise and its systems

Anthropic has denied allegations that a malicious version of the official Claude Code extension published to Cursor's marketplace was linked to a compromise of its own systems. The company said a malicious actor used access to Cursor's marketplace to publish a tampered copy that Anthropic did not build or publish. Cursor said the affected extension version was available for about 11 hours on Thursday and that it later shut down its VS Code marketplace out of caution.

Anthropic's response

Felix Rieseberg, a member of Anthropic's technical staff, said the company is working with Cursor on the incident. He said it was not a compromise of Anthropic's systems or employee laptops, and that versions on Anthropic's official channels are not affected. The issue only impacts Cursor users.

Cursor's account

The malicious package was first spotted by EDR vendor Phorion. An unknown party pushed an update to Cursor's official Claude Code extension for Visual Studio Code that contained a persistent SSH backdoor for Windows, macOS, and Linux. According to Cursor, extension version 2.1.313 was available to download between 0227 and 1335 PT, or 0927 and 2035 UTC, on Thursday. Analyses by the vendors found that the implant collected usernames, configured Git emails, and public IP addresses, and attempted to open a reverse SSH tunnel. Cursor said the package also contained a critical flaw: the script that opened the SSH tunnel required admin rights on macOS and Windows, and in the vast majority of cases did not have them, so it failed.

Remediation and response

Even where the tunnel failed, the extension still forwards the collected host and user data to the attacker, drops the attacker's SSH key, and installs a persistence mechanism. Developers must therefore go threat hunting in case their instance allows the SSH tunnel to be created successfully. Simply installing the latest version of the extension is not enough to clear the persistence mechanism. Cursor said it removed the malicious version immediately upon detection, blocked further distribution, ran checks to confirm no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server. Full remediation details and links to download scripts to wipe the infection are in Cursor's account of the situation.

Unanswered questions

Aside from Rieseberg's statement, neither Cursor nor Anthropic has commented on how the malicious package made its way to the official marketplace. Anthropic's position is that a malicious actor uploaded the tampered copy to Cursor, but Cursor has not outlined how it reached the marketplace.

This article follows our earlier report on the same marketplace incident, which described the malicious extension version and Cursor's first response. Read it here: previous report

Sources: The Register · Cyberplace.Social