Tampered copies of Anthropic's Claude Code extension were handed out through the extension marketplace of AI code editor Cursor for about 11 hours Thursday, adding an attacker's login key and hidden startup tasks to developers' Windows and Mac computers, The Register and BleepingComputer reported Friday. The incident shows that the stores feeding AI coding tools can deliver malicious code under a trusted name, and that affected machines need cleanup, not just an update.
What Happened
Cursor, whose editor is built on Microsoft's open-source Visual Studio Code, said in a security notice that a modified version was served from its own extension marketplace Oct. 29. It said Anthropic did not develop it and that it found no evidence Anthropic's official channels were affected.
According to Cursor, the added code sent the computer's name, user name and public internet address, among other details, to an attacker's server. It tried to add the attacker's key to those allowed to log in through SSH (Secure Shell, a standard remote-access tool), switch SSH on and open a reverse tunnel, an outbound connection that can let an attacker reach back in. A startup task retried that connection about once a minute.
BleepingComputer, citing researchers at Phorion and OpenSourceMalware, reported that the code ran as soon as the extension loaded, with no action by the user.
Switching SSH on requires administrator rights the extension usually lacked, so researchers said that step likely failed on many machines. The planted key, the startup task and the data upload could still succeed, and updating the extension does not remove them, The Register reported.
Cursor said it pulled the malicious version, temporarily shut its whole marketplace to audit it, found no other tampered extensions, rotated its keys and had the attacker's server taken offline. The Register reported claims that up to 5,000 developers were infected, a figure it did not verify. BankInfoSecurity attributed a ceiling of 5,000 users to Cursor, whose public notice gives no count.
The Unanswered Question
Felix Rieseberg, a member of Anthropic's technical staff, wrote on X that the incident "wasn't a compromise of Anthropic's systems or employee laptops," The Register reported, and that a malicious actor used access to Cursor's marketplace. Some prominent security figures alleged a breach at Anthropic, The Register reported; Anthropic denies it, and no evidence has been published. Neither company has explained how the attacker was able to publish under the official extension's identity.
Why It Matters
Extensions run with the developer's own permissions, often on machines holding source code, cloud keys and access to production systems. Editors built on Visual Studio Code run their own stores, so one tool reaches developers through several channels, each a separate target. Here the tampered copy carried the real name, so an automatic update from a trusted publisher was no proof of safety.
What to Watch
Cursor advises affected organizations to check machines for the attacker's SSH key, which its notice names, isolate any machine where it turns up, delete the key, startup task and tunnel, consider a rebuild and, from a clean system, change passwords, keys and sessions reachable from it.
Still open: Cursor's account of how publishing access was obtained, a firm user count and any sign the planted keys were used.
