Anthropic VS Code Extension Backdoored on Cursor

Anthropic VS Code Extension Backdoored on Cursor

A threat emerged. An official extension for Anthropic’s Claude model was compromised on the AI-assisted developer tool Cursor, potentially exposing the machines of up to 5,000 developers for nearly 12 hours, an alarming lapse in security protocols. The incident, where a malicious version of the extension was distributed via Anthropic's official account, has prompted major concerns about supply-chain security in developer tools. And we're seeing the fallout. Anthropic hasn't warned its customers yet.

The compromised package was identified as version 2.1.313 of the Anthropic extension, which was available on the Cursor marketplace. According to independent researcher Kevin Beaumont and security firm Phorian's CTO, Luke Roberts, this malicious version was uploaded to Anthropic's official account, effectively replacing a legitimate prior version. While Cursor extensions typically auto-update by default, users can adjust this setting. The compromised extension remained active for approximately 12 hours before Anthropic pushed out a corrected version, 2.1.314.

The Mechanics of the Attack

The security implications are massive. Roberts explained the attacker gained access to Anthropic's official distribution channel on Cursor, enabling them to publish the malicious code with concerning ease, establishing a foothold directly within a trusted software development environment. The primary goal of this backdoor, as detailed by Cursor, was to establish persistent access and exfiltrate sensitive data, a nefarious objective they aimed to achieve through several carefully crafted mechanisms. It's a serious breach.

• The extension attempted to install a persistent SSH backdoor by adding an attacker-controlled SSH key, thereby enabling the local SSH service.
• It aimed to open a reverse SSH tunnel back to an attacker-controlled server.
• The malicious code was designed to be cross-platform, affecting Windows, macOS, and Linux systems.
• Once installed, the backdoored version, running with the permissions of the Integrated Development Environment, could potentially access local files, source code, and various developer tools.

What the Backdoor Could Do

The extension was compromised. It gathered host and user data. This sensitive information included the system's hostname, username, operating system, architecture, the path to the home directory, environment variable names, currently active working directories, configured Git email addresses, and the public IP address of the affected machine, all of which provided attackers with a swift understanding of a device's potential worth and helped them prioritize their next moves. Attackers could quickly assess value.

"It was a supply-chain compromise where the attacker gained access to the official distribution channel," Luke Roberts, CTO and co-founder of security firm Phorian, stated. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312."

The code was cunning. It aimed to maintain the reverse SSH tunnel's presence, a persistent threat. On macOS, this meant deploying a LaunchAgent, a stealthy mechanism designed for continuous operation, while on Windows, the attackers employed a scheduled task, meticulously configured to execute with SYSTEM privileges for maximum impact, and as a failsafe, they included a Startup-script to ensure the tunnel's survival even if initial attempts failed. These background scripts constantly tried to re-establish the tunnel, a relentless cycle repeating roughly every minute. Collected host details and backdoor status were then sent out, transmitted via HTTP POST requests to a designated endpoint residing on port 8099.

Bugs existed. Phorian highlighted the persistent threat. Even though flaws in Windows and macOS code hampered some actions, the malware's ability to maintain its presence and extract reconnaissance data meant it posed a persistent and considerable danger, capable of widespread damage. Specifically, the theft of variable names offered attackers a swift route to identifying cloud credentials and API tokens, thereby accelerating their efforts to uncover and exploit additional vulnerabilities within systems.

Response and Lingering Questions

Following the discovery, Cursor personnel collaborated with the cloud provider hosting the server used for the reverse shell connections to block infected devices from communicating with it. The backdoored version was subsequently removed from the marketplace, and further distribution was halted. In a broader security measure, Cursor also temporarily shut down the VSCode Marketplace to facilitate key rotation, audit access controls, and ensure no other extensions had been compromised. The marketplace has since been reopened.

However, many questions still remain unanswered. It is unclear why Anthropic has not yet publicly alerted its user base to the threat, nor have the companies provided an explanation for how the supply-chain compromise occurred. Attempts to solicit this information from both companies reportedly went without a response.

Consider yourself affected. Developers who installed or updated the Anthropic VS Code extension on Cursor between 5:27 am ET and 4:35 pm ET on Thursday should take note. It's important to understand that even if you didn't actively download the extension within that timeframe, auto-update could still have impacted your system, given the nature of this security compromise. Both Cursor and Phorian have generously published indicators of compromise, which include specific IP addresses and cryptographic hashes, allowing users to effectively detect potential infection and secure their environments.