# Anthropic's Claude extension on Cursor shipped an SSH backdoor for nearly 12 hours

> A malicious update pushed through Anthropic's official Cursor marketplace account reached up to 5,000 developers. How the account was taken over is still unexplained.

- URL: https://dev.devisdead.ai/news/anthropic-s-claude-extension-on-cursor-shipped-an-ssh-backdoor-for-nearly-12-hou
- Published: 2026-10-31T15:55:50Z
- Author: DevIsDead Newsroom
- Section: Dev
- Tags: security, anthropic, cursor, supply chain
- Originally reported by Ars Technica (https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/).

The supply-chain attack everyone keeps warning about just landed inside an AI coding tool.

A backdoored version of Anthropic's official Claude extension for VS Code went out through Cursor's extension marketplace and could have reached as many as 5,000 developer machines, [Ars Technica](https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/) reported. Dan Goodin writes that the bad build stayed up for nearly 12 hours, and that Anthropic had not yet notified customers when the story ran.

## What happened

Version 2.1.313 of the extension was published from Anthropic's official account on Cursor, replacing 2.1.312, according to independent researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian. Cursor puts the number of affected users at 5,000 at most. Anthropic shipped a clean 2.1.314 several hours later. Neither company has said how the attacker got control of the account.

Cursor updates extensions automatically unless you change that setting, so many people didn't have to do anything to get the malicious build.

## What the payload does

Per Cursor's analysis, the code tries to set up persistent remote access: it adds an attacker-controlled SSH key, turns on the local SSH service and opens a reverse SSH tunnel. It targets Windows, macOS and Linux. Because extensions run with the editor's permissions, anything your IDE can reach, including source code, local files and developer tooling, was in scope.

## If you use Cursor

- Check whether 2.1.313 was ever installed. If it was, treat the machine as compromised, not as merely outdated.
- Look for unfamiliar keys in your SSH authorized keys, an SSH service you never enabled, and unexpected outbound tunnels.
- Rotate what that machine could see: cloud credentials, tokens, SSH keys, and secrets in local env files.
- Consider turning off auto-update for extensions that have deep access, or at least pinning versions on machines that hold production credentials.

## The bigger point

AI coding extensions are some of the most privileged software on a developer's machine. They read the repo, run commands and talk to the network by design. That makes their publisher accounts high-value targets, and it makes a quick, public disclosure from the vendor part of the product. Until Anthropic and Cursor explain the account takeover, the lesson for teams is simple: an extension's update channel is part of your attack surface.

**[Scoreboard](/scoreboard) update:** Humans +1. Security researchers catch a backdoored AI coding extension.

Stay undead.