Software · 31 October 2026 · 4 min read
Twelve Hours With a Backdoor: Anthropic's Official Cursor Extension Compromised
In brief: Anthropic's official Claude extension in the Cursor marketplace was compromised for nearly twelve hours, delivering a backdoor engineered to open reverse SSH tunnels and map cloud credentials on developer workstations. The incident impacted up to five thousand engineers before a clean release was deployed, exposing critical vulnerabilities in automated IDE plugin delivery systems.
by Team Mocchi's
A breach at the core of developer workstations
The software supply chain underpinning AI-assisted programming experienced a significant shock when Anthropic’s official extension for the Cursor IDE — a popular VS Code fork heavily leveraged by software engineering teams — was hijacked to push malicious code to developer laptops for almost twelve hours.
The compromised release, version 2.1.313, was automatically fetched and installed by an estimated five thousand developers before being pulled. What makes this incident particularly alarming is the distribution channel: rather than relying on typosquatting or imitation packages, the malicious update was published directly from Anthropic’s verified developer account on the official Cursor marketplace.
Hunting cloud credentials and establishing persistence
Technical breakdowns published shortly after the remediation reveal a highly targeted operational objective. As reported by Ars Technica, the payload first performed reconnaissance on the compromised system, logging hostnames, active usernames, operating system architectures, home directories, Git commit emails, and public IP addresses.
Critically, the malicious script harvested the names of all system environment variables. This allowed the operators to rapidly map out high-value targets, identifying machines holding cloud API keys (such as AWS, Azure, or GCP credentials), database connection strings, and production secrets stored in developer shells.
Simultaneously, the script attempted to insert an attacker-owned SSH key into the user’s authorized_keys file, start the local SSH daemon, and establish a reverse SSH tunnel for persistent remote shell access. Persistence was configured through macOS LaunchAgents or Windows scheduled tasks executing as SYSTEM, checking in via HTTP POST requests on port 8099 every sixty seconds. Security researchers noted that coding flaws within the malware prevented the tunnel from executing reliably on most endpoints unless the editor had been launched with elevated administrator privileges.
The verified account breach and silent remediation
Cursor quickly mitigated the issue by pushing version 2.1.314, but fundamental questions remain unanswered. Independent security researchers, including Kevin Beaumont and Phorian CTO Luke Roberts, verified that the malicious build originated from the genuine Anthropic publisher credential rather than an external injection.
Because extensions run with the ambient authority of the IDE itself, the compromised package had unfettered access to proprietary source code, private repositories, and local environment secrets. Despite this severity, Anthropic has yet to issue a comprehensive incident postmortem explaining how the account was compromised. With modern IDEs configured by default to silently update plugins in the background, enterprise development teams were left vulnerable through a trusted channel.
Mocchi's take
This incident highlights that local developer workstations have become the primary staging ground for attackers seeking entry into production cloud environments. Relying on unvetted background auto-updates for IDE extensions — even those originating from verified vendor accounts — is an operational risk engineering organizations can no longer afford. Development teams must lock down extension versions, isolate local environments within containers, and strictly enforce the segregation of secrets so production tokens never reside unencrypted in local environment variables.