An attacker's SSH key was embedded in a counterfeit Claude Code extension that persisted even after uninstallation. Anthropic has stated that its systems and employee devices remained secure throughout the incident.

Between approximately 2:27am and 1:35pm Pacific time on Thursday, 29 October, a compromised iteration of Anthropic's Claude Code extension was available in Cursor's extension marketplace. The malicious build reached as many as 5,000 users before being taken down. According to Cursor's security advisory, the tainted versions attempted to establish an SSH backdoor on developer workstations.

Anthropic has stated that its own infrastructure was not compromised. However, neither Anthropic nor Cursor has disclosed the mechanism by which the attacker obtained access to distribute the malicious extension through Anthropic's official account on Cursor's platform.

Technical Details of the Attack

Versions 2.1.312 and 2.1.313 for both Windows and macOS contained the malicious code. The compromised extension gathered system information from affected machines, including hostname, username, Git email configuration and public IP address. It subsequently attempted to install the attacker's SSH key and activate the machine's SSH service. The extension also tried to establish a reverse tunnel connection to the attacker's infrastructure.

The reverse tunnel operation would typically fail because it requires administrator privileges that the extension does not possess on most Windows and macOS systems, according to Cursor. Nevertheless, the SSH key installation, persistence mechanisms and data exfiltration succeeded regardless. Simply removing the extension may prove insufficient to eliminate the backdoor from affected systems.

Cursor responded by removing the affected versions and temporarily shutting down its entire extension marketplace to audit other offerings. The company subsequently rotated its security credentials, took the attacker's server offline and reopened the marketplace. Cursor has made available scripts that users can run to detect and eliminate the backdoor.

https://x.com/cursor_ai/status/2116074289053175808

Anthropic's Response

Felix Rieseberg, a technical staff member at Anthropic, posted a statement on X denying involvement in creating or distributing the malicious extension.

How the Attack Was Discovered

Security researchers at Phorion identified the compromise. Luke Roberts, the firm's co-founder and chief technology officer, explained to Ars Technica that the attacker successfully infiltrated the official distribution channel.

https://x.com/felixrieseberg/status/2116170451466543578

The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312

Luke Roberts, Phorion

Independent security researcher Kevin Beaumont corroborated this finding, as reported by Dan Goodin at Ars Technica. Because Cursor enables automatic extension updates by default, the malicious version propagated widely. Cursor has directed users to upgrade to version 2.1.314, which is clean.

Data Exfiltration

Phorion's analysis revealed that the malware transmitted the names of up to 40 environment variables associated with API keys, tokens and secrets, though not their actual values. This information provides attackers with a reconnaissance advantage, allowing them to identify which cloud service credentials are present on each compromised machine.

Supply-chain attacks targeting developer tools have proliferated throughout the year, particularly affecting npm packages. Security experts have cautioned that AI-powered coding assistants could potentially amplify the scope and impact of such attacks.

Source: The Next Web