An official extension for Claude, Anthropic’s model, was booby-trapped and could have threatened up to 5,000 developer workstations, according to several sources cited on Friday. Anthropic had not yet alerted its customers about the incident.
- The malicious version 2.1.313 of Anthropic’s Claude extension spread through Cursor’s marketplace.
- Up to 5,000 developers may have been affected.
- The backdoor gave attackers persistent access to local files and source code.
- Anthropic has not yet notified its customers.
The compromised extension was available on the marketplace of Cursor, a company that designs AI-assisted development tools. In a security advisory published on Friday, Cursor stated that the malicious version, 2.1.313, affected ‘at most’ 5,000 users, likely when they downloaded it or when their systems fetched and installed it automatically.
According to independent researcher Kevin Beaumont, Anthropic released version 2.1.314 several hours after the previous one went live on Cursor. Both Beaumont and Luke Roberts, CTO and co-founder of the security firm Phorion, state that version 2.1.313 was distributed from Anthropic’s official account on Cursor. Neither Cursor nor Anthropic have, so far, explained how the attackers took control of this account.
A Supply Chain Compromise
Luke Roberts describes an incident of the ‘supply chain compromise’ type, in which the attacker gained access to the official distribution channel. ‘The malicious version 2.1.313 was published on Anthropic’s official account, effectively replacing 2.1.312,’ he told Ars Technica. He notes that extensions update automatically by default in Cursor, but users can change this setting. Phorion has published further details in a blog post.
Anthropic has, at this stage, issued no public notice to its customers regarding this incident.
A Persistent Remote Access
According to Cursor, the malicious extension attempts to install a persistent backdoor, meaning a hidden access that persists over time, by relying on an access key controlled by the attacker. The code was designed to work on Windows, macOS, and Linux.
Cursor extensions run with the privileges of the integrated development environment, the tool in which programmers write their code. Therefore, the booby-trapped version could, according to the advisory, access local files, source code, and development tools on the machine once installed.
