Anthropic hacked to deliver remote access trojan

A compromised release of Anthropic’s Claude Code extension, version 2.1.313, was distributed through the Cursor marketplace and automatically updated on developer machines. With more than 40 million installations reported across VS Code and Cursor, the incident is described as a software supply-chain attack with potential exposure across developer laptops and desktops. The extension gathered device and user details - including host name, operating system, working directories, Git email, and public IP - and attempted to install an attacker-controlled SSH key, enable SSH access, and open a reverse tunnel for remote control.

The malicious code also tried to keep access persistent through macOS LaunchAgents or Windows scheduled tasks and startup scripts, retrying the tunnel about once a minute and sending host information and backdoor status to a server. Cursor acknowledged the compromised package, and Anthropic replaced version 2.1.313 with 2.1.314, which appeared to remove the backdoor code. Updating does not remove any backdoor already installed or undo the earlier collection of system information. Errors in the installer meant the SSH backdoor would generally fail unless Cursor was running with elevated privileges, but the reconnaissance activity could still occur. The account says Anthropic had not notified customers and points to detection queries for Microsoft Defender for Endpoint.