A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

Save this storySave this storyThe AI software-development platform Cursor, which is owned by SpaceX, had a malicious Anthropic Claude Code extension for Windows, macOS, and Linux live in its integrated development environment extension marketplace for roughly 11 hours on Thursday. The company says the rogue extension was downloaded by “at most 5,000 users.” Cursor briefly shut down the extension marketplace while it investigated the situation, which the company says did not impact any other extensions.

由 SpaceX 拥有的 AI 软件开发平台 Cursor，其集成开发环境扩展市场在周四上线了一个针对 Windows、macOS 和 Linux 的恶意 Anthropic Claude Code 扩展，该扩展存在了大约 11 个小时。该公司表示，该恶意扩展被“最多 5,000 名用户”下载。Cursor 在调查期间短暂关闭了扩展市场，并称此次事件未影响其他任何扩展。

The tainted extension was designed with a backdoor to give attackers access to victim devices—the type of implant that malicious hackers often use as a stepping stone to deeper control inside a target network. Cursor published remediation steps on Thursday for the roughly 5,000 affected targets. A saving grace of the situation, though, was a flaw in the malware’s design that blocked it from fully establishing itself on the vast majority of targets.

该受污染的扩展被设计了一个后门，旨在让攻击者能够访问受害者的设备——这是恶意黑客经常用作在目标网络内部获取更深层控制权的跳板。Cursor 在周四为大约 5,000 名受影响的目标用户发布了补救措施。然而，该事件的幸运之处在于，恶意软件设计中的一个缺陷阻止了它在绝大多数目标设备上完全建立连接。

“Everyone was so lucky here, this was potentially a really dangerous foothold for an foothold for an attacker,” says Calum Hall, cofounder and CEO of the detection firm Phorion, the first researchers to spot the malicious extension after detecting it on a customer’s Mac.

“大家在这里非常幸运，这对于攻击者来说可能是一个非常危险的立足点，”检测公司 Phorion 的联合创始人兼首席执行官 Calum Hall 说道。该公司是首批发现该恶意扩展的研究机构，此前他们在一位客户的 Mac 上检测到了它。

What is still unclear is how the malicious extension made its way into the Cursor marketplace at all. Some researchers initially speculated that it came from a compromised Anthropic system. But Cursor said in its Thursday security alert that “these malicious versions of the extension were not developed by Anthropic.”

目前尚不清楚该恶意扩展究竟是如何进入 Cursor 市场的。一些研究人员最初推测它来自被入侵的 Anthropic 系统。但 Cursor 在周四的安全警报中表示，“这些恶意版本的扩展并非由 Anthropic 开发。”

Felix Rieseberg, a member of Anthropic’s technical staff, posted on X on Friday: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.”

Anthropic 技术人员 Felix Rieseberg 周五在 X 上发文称：“我们正在就此事件与 Cursor 合作，但这并非 Anthropic 的系统或员工笔记本电脑遭到入侵。一名恶意行为者利用对 Cursor 市场的访问权限发布了一个被篡改的 Claude Code 扩展副本，该副本并非由我们构建或发布。我们官方渠道的版本不受影响，此事件仅影响 Cursor 用户。”

David Dworken, who works on security at Anthropic, posted on X shortly after, explaining that “this did not involve a compromise of any Anthropic systems … We were not involved with building, publishing, or hosting this.”

随后不久，在 Anthropic 从事安全工作的 David Dworken 也在 X 上发文解释道：“这不涉及任何 Anthropic 系统的入侵……我们没有参与构建、发布或托管此内容。”

Cursor did not return WIRED’s request for comment about how the malicious upload happened and whether it was the result of a breach at Cursor.

对于恶意上传是如何发生的，以及这是否是 Cursor 内部遭到入侵的结果，Cursor 没有回应《连线》（WIRED）的置评请求。