A trusted AI coding extension becomes a supply-chain vector

An official Visual Studio Code extension for Anthropic’s Claude model was backdoored on Cursor’s marketplace for nearly 12 hours, potentially exposing as many as 5,000 developers’ machines to a supply-chain attack, according to multiple reports Friday. The compromised package was version 2.1.313 of the Claude Code extension, distributed through Anthropic’s official account on Cursor, a maker of AI-assisted developer tools. Cursor confirmed the compromise, while Anthropic had not warned customers as of Ars Technica’s report.

The malicious version superseded 2.1.312 and was replaced by 2.1.314 several hours later, according to independent researcher Kevin Beaumont. Phorian CTO and co-founder Luke Roberts said the package reached users through the official distribution channel, not through a lookalike publisher or typo-squatted listing. That detail makes the incident especially troubling: the attackers did not need developers to make an obvious mistake. They compromised the trust chain itself.

What happened, and how the attack worked

Cursor’s marketplace distributes extensions for its AI-assisted coding environment. Extensions auto-update by default in Cursor, though users can change that setting. Once version 2.1.313 appeared under Anthropic’s account, developers who had the extension installed could have received it automatically, or downloaded it manually, during the window before Anthropic pushed 2.1.314. Cursor said the incident affected at most 5,000 users; Ars Technica reported the backdoor threatened as many as 5,000 developers’ machines.

Security outlets described the payload in blunt terms. The Hacker News headline called the official Claude Code extension on Cursor Marketplace “trojanized with persistent SSH backdoor.” BankInfoSecurity led with Cursor’s confirmation that the Anthropic Claude Code extension had been compromised. MSN framed the story around Cursor’s estimate that up to 5,000 users were affected by the tampered extension. The common thread: a trusted developer tool carried malicious code, and the distribution mechanism was the publisher’s own account.

“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Roberts told Ars Technica. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.”

Researchers said the malicious code appeared to search for cloud credentials, and The Hacker News headline pointed to a persistent SSH backdoor. Those details matter because developers’ machines are often gateways to source code repositories, cloud consoles, production infrastructure and secrets. A backdoor that persists via SSH could give an attacker continued access even after the malicious extension was removed, while credential theft could extend the intrusion into other systems.

Unanswered questions and competing frames

The most important question remains unanswered: how did attackers gain control of Anthropic’s official account on Cursor? Neither Cursor nor Anthropic has explained the account takeover, according to Ars Technica. That gap leaves open whether the compromise came from stolen credentials, session hijacking, a weakness in marketplace account controls, or another route. It also leaves developers unable to judge whether the same path remains open.

Coverage of the incident reflected different priorities. Ars Technica focused on the mechanics of the supply-chain compromise and on Anthropic’s failure, as of its report, to warn customers. The Hacker News emphasized the payload, calling it a trojanized extension with a persistent SSH backdoor. BankInfoSecurity centered Cursor’s confirmation, while MSN highlighted the 5,000-user estimate. Together, the accounts describe a short but serious window in which a legitimate publisher’s channel became an attack vector.

The disclosure also raises questions about marketplace security. Extension marketplaces rely on publisher accounts, signing and review processes, but auto-update defaults mean users can receive a malicious build without taking any action. A compromised publisher account can bypass the expectation that developers will inspect each update. For AI coding tools, the stakes are higher because such tools often request broad permissions to read code, run commands and interact with cloud services.

Why it matters beyond Cursor

The incident is part of a broader pattern of software supply-chain attacks targeting package registries, browser extensions and developer-tool marketplaces. Attackers increasingly prefer trusted distribution channels over phishing because they scale automatically and inherit the credibility of the publisher. The Claude Code extension case shows how quickly a single compromised account can turn an auto-updating developer tool into a foothold across many machines.

For Anthropic and Cursor, the episode will sharpen scrutiny of account security, publication controls and disclosure practices. For developers, it is a reminder that AI assistants and editor extensions sit close to sensitive credentials. The 12-hour window may be short by some standards, but auto-updates can propagate quickly across engineering teams.

What developers should do

• Check whether Claude Code extension version 2.1.313 was installed; if it was, treat the machine as potentially compromised.
• Rotate cloud credentials, API keys and SSH keys that were accessible from affected development environments.
• Review authentication logs, outbound network connections and SSH authorized_keys files for unexpected changes.
• Consider disabling automatic extension updates or pinning reviewed versions, especially in high-trust development environments.
• Verify publisher identities and signatures where marketplaces support them, and monitor advisories from Anthropic, Cursor and security researchers.

As of Friday, the key unresolved issue was not the malicious version itself but the response around it. Version 2.1.314 replaced the compromised build, yet neither company had publicly explained the account takeover. Until that happens, developers are left to treat the incident as both a contained malware event and a warning about the trust assumptions built into AI-assisted software development.