Supply-Chain Attack Hits Anthropic's Cursor Extension, Exposing AI Developers

A verified Anthropic account on the Cursor marketplace pushed a backdoored VS Code extension (version 2.1.313) that remained live for roughly 12 hours before a patched version 2.1.314 replaced it. Independent researcher Kevin Beaumont and security firm Phorian confirmed the malicious package was distributed through Anthropic's official channel, affecting an estimated 5,000 developers who either downloaded it manually or received it via auto-update.

The implanted code targeted Windows, macOS, and Linux hosts. It collected host identifiers, usernames, environment variable names, Git configuration, and public IP addresses, then attempted to inject an attacker-controlled SSH key, enable the local SSH daemon, and establish a reverse tunnel that would persist via LaunchAgent on macOS or scheduled tasks on Windows. Bugs in the payload prevented full execution on some platforms, but the intent was clear: gain persistent remote access to developer workstations.

Why it matters for GPU / AI infrastructure

AI development workflows increasingly rely on curated extension marketplaces and auto-updating toolchains. A single compromised publisher account can bridge into GPU-backed training environments, exposing model weights, dataset pointers, and cloud API tokens stored on the same machines. For teams running workloads on shared GPU clusters or cloud instances, this class of supply-chain breach underscores the need for signed, reproducible builds and strict least-privilege policies on developer tooling.

Neither Anthropic nor Cursor has disclosed how the publisher account was hijacked, and Anthropic has yet to notify affected customers directly. Until root-cause analysis is published, organizations should audit extension inventories, pin versions in CI/CD pipelines, and monitor for anomalous outbound connections on port 8099—the beacon endpoint used by the backdoor.