{"schema_version":"0.10.0","id":"LR-2026-0281","record_version":2,"title":"Backdoored Anthropic Claude VS Code extension on Cursor marketplace (v2.1.313) installs SSH backdoor for up to 5,000 developers","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":69.6,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":12.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-31","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Ars Technica · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-31","history":[{"date":"2026-10-31","from_level":null,"to_level":"preliminary","reason":"1 report: Ars Technica · subject to change"}]},"sources_hash":"68dd638bbb5b6b1103cc9c0597b47c8dfa23d822358d791a1bd2e5ccab937a33"},"system":{"model_name":"Claude Code","model_version":"2.1.313","developer":"Anthropic","harness":"Claude Code VS Code extension on the Cursor Marketplace","tools_granted":[],"permissions_scope":"Permissions of the Cursor Integrated Development Environment, giving access to local files, source code, and developer tooling","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":"enterprise","lifecycle_stage":"production","integration_type":"embedded","intended_use":"VS Code extension for Claude Code distributed via the Cursor Marketplace","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-30","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A malicious version 2.1.313 of Anthropic's official Claude Code VS Code extension was posted to the Cursor Marketplace and was downloadable for about 11 hours, reaching at most 5,000 users.","tags":["supply-chain","extension-marketplace","ssh-backdoor","developer-tooling"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"unknown","adversarial_actor":"external_attacker","input_provenance":"tampered extension.js in the Claude Code VS Code extension published on the Cursor Marketplace","time_to_contain":null,"operations_paused":"The Cursor Marketplace was taken offline Thursday afternoon and reinstated after review.","remediation":"Marketplace taken down and reviewed, attack server taken offline with the cloud provider, marketplace reinstated, users contacted, instructions published, and Anthropic issued version 2.1.314 omitting the malicious code.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":5000,"severity":"major","severity_because":"major: A live production compromise of up to 5,000 users who downloaded the backdoored extension from the Cursor Marketplace.","harm_class":["third_party_security"],"affected_description":"at most 5,000 users who downloaded version 2.1.313 of the extension","protected_class_involved":null,"data_categories_exposed":["credentials","source_code"],"loss_range_usd":null,"reversibility":"partial","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/","publisher":"Ars Technica","date":"2026-10-30","type":"press","title":"Anthropic VS code extension on Cursor backdoored for nearly 12 hours","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.govinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263","publisher":"GovInfoSecurity","date":"2026-10-30","type":"press","title":"Cursor Confirms Anthropic Claude Code Extension Compromised","archived_url":null,"attachment":"fingerprint"}],"per_field_confidence":{"system.model_name":"C","system.model_version":"D","system.harness":"C","system.permissions_scope":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.tags":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.operations_paused":"C","event.remediation":"C","event.agent_involved":"D","event.trigger":"D","event.detection_method":"C","event.summary":"D","event.incident_class":"C","event.date_disclosed":"A","impact.third_parties_affected_count":"C","impact.harm_class":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.reversibility":"D","impact.severity":"D","context.industry":"D","context.systemic_exposure":"C","context.shared_model_id":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":1,"quote":"Attackers backdoored the official Claude Code VS Code extension being distributed on the Cursor Marketplace."}],"system.model_version":[{"source_index":1,"quote":"San Francisco-based Cursor, owned by SpaceX subsidiary SpaceXAI, said in a security alert that the malicious version, 2.1.313, of the official Claude Code extension was available from the Cursor Marketplace Thursday from approximately 9:27 a.m. to 8:35 p.m. UTC."}],"system.developer":[{"source_index":0,"quote":"An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday."}],"system.harness":[{"source_index":1,"quote":"The malicious version of the extension, downloadable for 11 hours on Thursday, was designed to give attackers persistent SSH access to any endpoint on which the extension was installed."}],"system.permissions_scope":[{"source_index":0,"quote":"Because Cursor extensions run with the permissions of the tool’s Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed."}],"system.deployment_context":[{"source_index":1,"quote":"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."}],"system.lifecycle_stage":[{"source_index":1,"quote":"The malicious version of the extension, downloadable for 11 hours on Thursday, was designed to give attackers persistent SSH access to any endpoint on which the extension was installed."}],"system.integration_type":[{"source_index":1,"quote":"Because extensions run with the permissions of the IDE and the user running it, a backdoored extension gets immediate access to local files, source code and developer tooling as soon as its module is loaded,"}],"system.intended_use":[{"source_index":1,"quote":"The company develops the Cursor artificial intelligence coding agent and software development environment, and offers the Cursor Marketplace to serve extensions for the Cursor editor."}],"event.trigger":[{"source_index":0,"quote":"So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account."}],"event.detection_method":[{"source_index":1,"quote":"Phorion, which develops macOS endpoint detection and response tools, appeared to be the first to publicly flag the malicious extension, which it said featured the ability to execute on any Windows, Linux or macOS system, and could gain access to many different types of data."}],"event.summary":[{"source_index":1,"quote":"San Francisco-based Cursor, owned by SpaceX subsidiary SpaceXAI, said in a security alert that the malicious version, 2.1.313, of the official Claude Code extension was available from the Cursor Marketplace Thursday from approximately 9:27 a.m. to 8:35 p.m. UTC."}],"event.tags":[{"source_index":0,"quote":"“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars."}],"event.responsible_party":[{"source_index":0,"quote":"So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account."}],"event.adversarial_actor":[{"source_index":1,"quote":"A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing or hosting this,"}],"event.input_provenance":[{"source_index":1,"quote":"Security researcher Paul McCarty said in a Friday report posted to the OpenSource Malware site that the malicious version was the same as the legitimate version except for its extension.js file, which gets run whenever the extension starts up, and which \"contains a malicious 66-line loader inserted before the legitimate extension code,\" meaning users wouldn't need to first interact with Claude for the attack to commence."}],"event.operations_paused":[{"source_index":1,"quote":"\"In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware and have reinstated the marketplace after confirming there is no further risk,\" it said."}],"event.remediation":[{"source_index":1,"quote":"Anthropic issued version 2.1.314 of the extension, which omits the malicious code, Thursday evening."}],"event.incident_class":[{"source_index":1,"quote":"Attackers backdoored the official Claude Code VS Code extension being distributed on the Cursor Marketplace."}],"event.agent_involved":[{"source_index":1,"quote":"Attackers backdoored the official Claude Code VS Code extension being distributed on the Cursor Marketplace."}],"impact.third_parties_affected_count":[{"source_index":1,"quote":"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."}],"impact.harm_class":[{"source_index":1,"quote":"The malicious version of the extension, downloadable for 11 hours on Thursday, was designed to give attackers persistent SSH access to any endpoint on which the extension was installed."}],"impact.affected_description":[{"source_index":1,"quote":"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."}],"impact.data_categories_exposed":[{"source_index":1,"quote":"The reconnaissance conducted by the implant includes gathering the hostname and local username, details of the operating system and CPU architecture, home and the current directory name, the global Git email address attached to code commits, as well as \"names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP,\" he said."}],"impact.reversibility":[{"source_index":1,"quote":"\"The new, replacement versions Anthropic published overnight - which auto update - do *not* remove the prior backdoors and recon activity. So, SSH still reverse calls out, etc., you need to manually remediate every impacted VS Code and Cursor system,\" said British cybersecurity researcher Kevin Beaumont in a Friday post to social platform Mastodon."}],"impact.severity_because":[{"source_index":1,"quote":"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."}],"context.industry":[{"source_index":1,"quote":"The company develops the Cursor artificial intelligence coding agent and software development environment, and offers the Cursor Marketplace to serve extensions for the Cursor editor."}],"context.country":[{"source_index":1,"quote":"San Francisco-based Cursor, owned by SpaceX subsidiary SpaceXAI, said in a security alert that the malicious version, 2.1.313, of the official Claude Code extension was available from the Cursor Marketplace Thursday from approximately 9:27 a.m. to 8:35 p.m. UTC."}],"context.systemic_exposure":[{"source_index":1,"quote":"This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products,"}],"context.shared_model_id":[{"source_index":0,"quote":"The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they either downloaded it or their systems automatically fetched and installed it."}],"impact.severity":[{"source_index":1,"quote":"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-30"}]},"notes_on_gaps":"No source states a dollar loss figure, remediation hours, records exposed, protected class, org size band, denominator, regulatory regimes, litigation, or coverage posture. event.date_occurred is taken as 2026-10-29 (Thursday) from Cursor's stated availability window; only the disclosure date 2026-10-30 is explicit. event.duration is bounded by the two timeline items (marketplace availability 9:27 a.m. to 8:35 p.m. UTC Thursday) and computed by the pipeline. Detection is contested: Ars credits independent researcher Kevin Beaumont, GovInfoSecurity says Phorion appeared first to publicly flag it; third_party is written as the better-supported value. Root cause is contested: Ars says neither party explained how the account was taken over (unknown), while Anthropic states a malicious actor used access to Cursor's marketplace (integration). responsible_party left unknown because sources disagree on whether Anthropic's or Cursor's channel was at fault. systemic_exposure written false per Cursor's statement that other extensions and products are unaffected, against Ars's classification of true. No source states an approval or sandbox control existed; the marketplace takedown and review is the only disclosed control. agent_involved false: the harm came from attacker-inserted code in an extension, not an autonomous agent. event.date_occurred: a source described it but did not state it; left null. event.root_cause: the stated reason names an absence, not a failed control: Anthropic states a malicious actor used access to Cursor's marketplace to publish a tampered extension; Cursor has not shared how the supply-chain attack was carried out. system.tier: enterprise by rule (operator Anthropic, distributing through Cursor's marketplace differs from developer Anthropic). Sources disagree on context.systemic_exposure: [0] \"true\", [1] \"false\"; event.detection_method: [0] \"public_researcher\", [1] \"third_party\"; event.root_cause: [0] \"unknown\", [1] \"integration\"; impact.affected_description: [0] \"as many as 5,000 developers' machines\", [1] \"at most 5,000 users who downloaded version 2.1.313 of the extension\"; system.harness: [0] \"VS Code extension for Anthropic's Claude model, distributed via the Cursor extension marketplace\", [1] \"Claude Code VS Code extension on the Cursor Marketplace\"; system.intended_use: [0] \"Official VS Code extension for Anthropic's Claude model used by developers in Cursor\", [1] \"VS Code extension for Claude Code distributed via the Cursor Marketplace\"; system.model_name: [0] \"Claude (extension version 2.1.313)\", [1] \"Claude Code\". [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-31] system.model_version: classified from described behaviour. system.lifecycle_stage: production. system.integration_type: embedded. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.agent_involved: classified from described behaviour. event.trigger: no source states a cause. event.summary: classified from described behaviour. impact.harm_class: classified from described behaviour. impact.reversibility: partial. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident."},"context":{"industry":"Software Publishers","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":"2.1.313","upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Cursor distributed the official Claude Code VS Code extension through its Cursor Marketplace to Cursor IDE users. Extensions run with the IDE's and user's permissions, giving access to local files, source code and developer tooling.","quote":"Because extensions run with the permissions of the IDE and the user running it, a backdoored extension gets immediate access to local files, source code and developer tooling as soon as its module is loaded,","source_index":1,"grade":"C"},{"step":"went_wrong","text":"A tampered version 2.1.313 carried a malicious loader that added an attacker-controlled SSH key, tried to enable local SSH and open a reverse tunnel, installed persistence and beaconed host details, breaching the marketplace's integrity.","quote":"The loader \"adds an attacker-controlled key to the user's SSH configuration, attempts to enable the local SSH service, establishes a reverse tunnel to 134.209.82.225, installs platform-specific persistence and transmits host reconnaissance over an unencrypted HTTP beacon,\" while also suppressing any errors that might normally get generated, McCarty said.","source_index":1,"grade":"C"},{"step":"reached","text":"Up to 5,000 users downloaded it; on infected endpoints it touched SSH configuration, persistence and host reconnaissance including environment variable names for keys, tokens and secrets.","quote":"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.","source_index":1,"grade":"C"},{"step":"caught","text":"Phorion, a macOS endpoint detection and response vendor, appeared to be the first to publicly flag the malicious extension.","quote":"Phorion, which develops macOS endpoint detection and response tools, appeared to be the first to publicly flag the malicious extension, which it said featured the ability to execute on any Windows, Linux or macOS system, and could gain access to many different types of data.","source_index":1,"grade":"C"},{"step":"done","text":"Cursor took the marketplace offline, worked with the hosting cloud provider to take the attack server offline, reviewed other extensions, reinstated the marketplace, said it would contact affected users and published detection instructions; Anthropic issued version 2.1.314.","quote":"\"In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware and have reinstated the marketplace after confirming there is no further risk,\" it said.","source_index":1,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-31","source_urls":["https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/","https://www.govinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263"]}}