"We're working with Cursor on this incident, but it wasn’t a compromise of Anthropic's systems or employee laptops." — Felix Rieseberg, Anthropic technical staff
Anthropic's denial and what it says it did
Anthropic responded to allegations that a malicious build of the official Claude Code extension in Cursor’s Visual Studio Code marketplace was the result of a breach of its own systems. Felix Rieseberg, a member of Anthropic’s technical staff, said the company is "working with Cursor on this incident, but it wasn’t a compromise of Anthropic's systems or employee laptops." He added that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish," and clarified that "the versions on our official channels are not affected, and this only impacts Cursor users."
Phorion's discovery and the implant's technical footprint
EDR vendor Phorion was the first to spot the tampered package. The malicious update — Cursor's Claude Code extension version 2.1.313 — contained a persistent SSH backdoor implemented for Windows, macOS and Linux. Vendors' analyses showed the implant collected host and user data, including usernames, configured Git emails and public IP addresses, and attempted to open a reverse SSH tunnel back to an attacker-controlled server.
Crucially, analysts found a critical flaw: the script that opened the SSH tunnel required administrator rights on macOS and Windows. In the "vast majority of cases" those rights were not present and the reverse tunnel failed. Even where the tunnel failed, the package still forwarded collected host and user data to the attacker, dropped the attacker's SSH key, and installed a persistence mechanism on the host.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow long it was live and who was affected
Cursor reports the malicious package — version 2.1.313 — was available for about eleven hours, between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday. Cursor and vendor reports say the compromised build infected up to 5,000 developers. The exposure window, the implant’s data collection, and the persistence artifacts together produced a situation where affected users may be partially compromised even if the SSH tunnel never successfully established.
Cursor's containment steps and remediation guidance
Cursor said it "removed the malicious version from the marketplace immediately upon detection and blocked further distribution." The company also carried out a full shutdown of the VSCode Marketplace "out of an abundance of caution," ran checks to confirm that no other extensions were compromised in the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the connection to the attacker's server.
Cursor published full details of remediation steps and provided downloadable scripts to remove the infection; it warned that simply installing the latest version of the extension is not sufficient to clear the persistence mechanism and that affected developers must perform threat-hunting to determine if their instances created a successful SSH tunnel and whether persistence artifacts remain.
What this means for developers, Cursor, and Anthropic
- Developers and security teams: teams that used Cursor's Claude Code extension should follow Cursor’s published remediation scripts and hunt for persistence artifacts and any active reverse SSH tunnels, because installing an updated extension alone will not remove the attacker's SSH key or persistence mechanism.
- Cursor and marketplace operators: Cursor has already taken steps to remove the package, shut down and restore the marketplace, rotate keys, and block attacker infrastructure; it will need to explain how the tampered copy was uploaded and demonstrate controls that prevent a repeat of a build being published under another project's name.
- Anthropic and vendor partners: Anthropic has asserted the tampered package did not come from its build systems or employee devices and said its official channels are unaffected; it will be focused on working with Cursor and on communications to users who may have installed the marketplace package.
Two facts stand out: the implant was live in an official marketplace for roughly eleven hours and up to 5,000 developers were impacted, and neither Cursor nor Anthropic has described how the malicious package made its way into Cursor’s marketplace. Cursor says it removed the package immediately and restored normal operations after rotating keys and blocking the attacker's infrastructure, while Anthropic maintains the compromised build was not produced by its systems. The next concrete step left on the record is a clarifying explanation of the upload path into Cursor’s marketplace and any gaps that allowed a tampered copy to be published under a known extension name.
