Anthropic hacked to deliver remote access trojan to Claude developer laptops

A supply-chain compromise affected version 2.1.313 of Anthropic’s Claude Code extension for Visual Studio Code and Cursor, which was distributed through Cursor’s marketplace and could install automatically. The extension had more than 40 million installations, putting developers’ computers at risk. The account says Anthropic replaced the package with version 2.1.314 and removed the compromised release, while customers were not notified; Cursor separately acknowledged that a malicious extension package had been available. The replacement removes the reported backdoor from the extension but does not clean computers that may already have been infected.

The malicious code gathered identifying details about the computer and user, including the hostname, operating system, working directories, Git email, and public IP address. It then tried to add an attacker-controlled SSH key, enable SSH, and create a reverse tunnel for remote access. The author notes that errors meant this installation step would generally fail unless Cursor had administrator privileges. The malware also attempted persistence through macOS LaunchAgents or Windows scheduled tasks and startup scripts, retrying the tunnel about every minute, and sent host details and backdoor status to a server. Security researchers detected the activity, and Microsoft Defender hunting queries were published to help organizations find affected systems.