A malicious build of Anthropic's Claude Code extension for the Cursor editor spent some time on developers' machines trying to hand a stranger a permanent SSH key. According to Cursor, the attempt was badly written and mostly failed. About 5,000 systems were still affected, which is a lot of laptops to leave to the mercy of someone else's sloppy code.
The package was version 2.1.313, and it carried a remote access trojan (RAT). Here is what is known about how it got there, what it did, and what it left behind.
What the extension collected
Before doing anything ambitious, the extension took inventory. The report lists these items:
- the device name and the user account
- the operating system and its architecture
- the home directory and working directories
- the names of environment variables
- the email address set in Git configuration
- the public IP address
The source says "names" of environment variables, and nothing about their values. It does not say whether values were read.
The extension also reported system details and the status of its own backdoor to a server controlled by the attacker. So the attacker got a running tally of which machines were worth the trouble.
A backdoor that mostly did not open
The main goal was persistent remote access. The code tried to add the attacker's SSH key to the list of allowed keys, switch on the local SSH service, and build a reverse SSH tunnel. A reverse tunnel matters because the infected machine dials out, so the attacker can reach it from outside even if inbound connections are normally blocked.
Cursor's description is less alarming than the design. Because of flaws in the malicious code, the persistent-access step in most cases should have ended in an error. It only worked under unusual conditions, such as Cursor running with administrator rights. The scripts retried roughly once every 60 seconds, so a machine that did meet those conditions would not have waited long.
That is a small comfort and not much more. A flawed backdoor on 5,000 machines is still a backdoor on some of them, and the report does not say how many.
Whose package was it
The attribution is where the account gets slightly awkward. Cursor says Anthropic did not write the malicious package. In its telling, an attacker used access to the Cursor marketplace to upload the modified version.
The author of the original disclosure adds a detail that complicates the reassurance. The package was published under a verified Anthropic account. That is the part developers actually see when they decide whether to click install.
The two statements fit together if you read the incident as a software supply chain attack. Someone got into the distribution channel and used it. The report is explicit that this was not a compromise of Anthropic's own infrastructure. For a developer deciding whether to trust an extension, though, the distinction between "Anthropic was hacked" and "Anthropic's name was used on a package it did not write" is a fine one.
Version 2.1.314 is not a cleanup
After the incident was found, version 2.1.313 was pulled from the marketplaces and replaced by 2.1.314. Updating is the obvious reflex, and it is incomplete.
The update does not remove an SSH backdoor that was already created. If the earlier build managed to plant a key or enable the SSH service, the newer extension version leaves those in place. The author of the report also says they cannot yet confirm that the new version is entirely free of malicious code. That is a careful way of saying the matter is not closed.
Who spotted it, and what is still unknown
Specialists at Phorion were the first to notice suspicious activity on users' computers. They published KQL queries for finding traces of the infection in Microsoft Defender for Endpoint, which is useful if your organization runs it and less useful if it does not.
Cursor acknowledged the incident and gave the scale of the compromise. What the source does not contain is any figure for how many infected systems actually ended up with a working remote access channel. Given Cursor's own description of the code's flaws, that number is probably smaller than 5,000, but the report does not say so and neither should anyone else.
What to check
The report does not include a remediation checklist, so the following is inference from the behaviour it describes. If you had the Claude Code extension in Cursor around this release, the sensible checks follow the malware's own steps:
- Look for an SSH key in your list of allowed keys that you did not put there.
- Check whether the local SSH service is running when you did not turn it on.
- Look for outbound SSH tunnels you do not recognize.
- If you use Microsoft Defender for Endpoint, run the published KQL queries.
Removing the extension version is not enough on its own, for the reason above.
The figure of 5,000 counts the systems the incident touched. The number that matters is how many of them ended up with a working door, and so far nobody has published it.