Anthropic VS code extension on Cursor backdoored for nearly 12 hours

An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. Anthropic so far has yet to warn customers of the incident.

据多家消息来源周五报道，Anthropic 公司 Claude 模型的一款官方扩展程序被植入后门，威胁到了多达 5,000 台开发人员的机器。截至目前，Anthropic 尚未就此事件向客户发出警告。

The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday. The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they either downloaded it or their systems automatically fetched and installed it.

该公司周五表示，受影响的软件包是一款在 AI 辅助开发工具制造商 Cursor 的市场中提供的 VS Code 扩展程序。恶意版本 2.1.313 随后影响了“最多 5,000 名用户”，推测是在他们下载该版本，或系统自动获取并安装该版本时发生的。

Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor.

据独立研究员凯文·博蒙特（Kevin Beaumont）称，在上一版本于 Cursor 上架数小时后，Anthropic 推送了 2.1.314 版本。博蒙特与安全公司 Phorian 的首席技术官兼联合创始人均表示，2.1.313 版本是通过 Anthropic 在 Cursor 上的官方账户分发的。

So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account. In search of cloud credentials “It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars.

到目前为止，Cursor 和 Anthropic 均未解释攻击者是如何获得该账户控制权的。在寻找云凭据的过程中，Phorian 首席技术官兼联合创始人卢克·罗伯茨（Luke Roberts）告诉 Ars：“这是一次供应链攻击，攻击者获得了官方分发渠道的访问权限。”

“The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.” Phorian has more details here. Anthropic has yet to issue public notice of the incident to customers.

“恶意版本 2.1.313 被发布到 Anthropic 官方账户，实际上取代了 2.1.312。Cursor 中的扩展程序默认会自动更新，但用户可以在设置中进行配置。” Phorian 在此处提供了更多详细信息。Anthropic 尚未就此事件向客户发布公开通知。

Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux.

Cursor 表示，该恶意扩展程序试图通过添加攻击者控制的 SSH 密钥来安装持久性 SSH 后门，启用本地 SSH 服务，并打开反向 SSH 隧道。该代码旨在适用于 Windows、macOS 和 Linux 系统。

Because Cursor extensions run with the permissions of the tool’s Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed.

由于 Cursor 扩展程序是在该工具的集成开发环境权限下运行的，因此一旦安装，被植入后门的版本很可能会获得对本地文件、源代码和开发工具的访问权限。

Cursor said the capabilities of the backdoor include: Collecting host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Cursor 表示，该后门的功能包括：收集主机和用户信息，如主机名、用户名、操作系统、架构、主目录路径、环境变量名称、工作目录、配置的 Git 电子邮件和公网 IP。

Attempting to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.

尝试将攻击者控制的 SSH 密钥添加到 authorized_keys，启用本地 SSH 服务，并打开反向 SSH 隧道。除非在极少数以管理员权限启动 Cursor 的情况下，否则由于恶意代码中的错误，此步骤通常会失败。

Attempting to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.

尝试通过 LaunchAgent（macOS）或以 SYSTEM 权限运行并带有启动脚本回退功能的计划任务（Windows）使反向 SSH 隧道保持持久性。后台脚本大约每 60 秒重试一次隧道连接。

Reporting host details and backdoor status via HTTP POST to /beacon on port 8099. Phorion said the theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on a compromised device, likely so it could prioritize which machines to target in follow-up attacks.

通过端口 8099 向 /beacon 发送 HTTP POST 请求，报告主机详细信息和后门状态。Phorion 表示，窃取变量名称使操作者能够快速清点受感染设备上存储的云凭据和 API 令牌，这很可能是为了在后续攻击中优先选择目标机器。

Bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases. Phorion said that despite the coding flaws, “the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator.”

Windows 和 macOS 恶意代码中的漏洞在某些情况下阻止了后门的运行。Phorion 表示，尽管存在编码缺陷，“该恶意软件仍然是一个重大威胁，它会安装持久性程序并将主机侦察信息回传给操作者。”

Cursor said company personnel worked with the cloud provider hosting the server the reverse shell connected to so that infected devices could no longer reach it. Personnel also removed the backdoored version from the marketplace and blocked further distribution.

Cursor 表示，公司人员已与托管反向 Shell 连接服务器的云服务提供商合作，使受感染设备无法再连接到该服务器。工作人员还从市场中删除了被植入后门的版本，并阻止了进一步的分发。

The company also shut down the VSCode Marketplace to rotate keys, audit access controls, and confirm no other extensions were compromised. The marketplace is now open. It remains unclear why Anthropic isn’t publicly warning customers of the threat and why it and Cursor aren’t explaining how the supply-chain compromise happened.

该公司还关闭了 VSCode 市场以轮换密钥、审计访问控制并确认没有其他扩展程序受到损害。目前市场已重新开放。目前尚不清楚为什么 Anthropic 没有公开向客户警告这一威胁，以及为什么它和 Cursor 没有解释供应链攻击是如何发生的。

Neither company answered questions seeking this information. Anyone who installed or updated Anthropic’s VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected, although it may be wise for anyone who has recently done so to also consider themselves potentially infected.

两家公司均未回答寻求此信息的提问。任何在周四美国东部时间上午 5:27 至下午 4:35 之间从 Cursor 安装或更新了 Anthropic VS Code 扩展程序的人都应认为自己受到了影响，尽管对于任何最近进行过此操作的人来说，将自己视为潜在感染者也是明智之举。

Both Cursor and Phorion list various indicators of compromise, including IP addresses and cryptographic hashes.

Cursor 和 Phorion 都列出了各种入侵指标，包括 IP 地址和加密哈希值。