A supply-chain attack hit developers who use Anthropic's Claude extension inside Cursor, the AI-assisted code editor, according to reporting by Ars Technica's Dan Goodin on October 30, 2026. A tampered release of the extension, version 2.1.313, appeared on Cursor's extension marketplace under Anthropic's verified publisher account. Cursor says the release reached at most 5,000 users, most likely those who downloaded it manually or whose editors fetched it automatically. Independent researcher Kevin Beaumont reported that Anthropic shipped a clean follow-up, version 2.1.314, several hours later.

How the attack worked

Phorian CTO and co-founder Luke Roberts described the incident as a compromise of the official distribution channel. The malicious build was published to Anthropic's account and superseded the legitimate 2.1.312 release. Cursor auto-updates extensions by default, though users can change that setting, which widened the exposure window. Neither Cursor nor Anthropic has said how the attackers obtained control of the publisher account, and neither answered questions from Ars Technica on the matter.

Cursor's analysis says the extension tried to establish a persistent SSH foothold. It attempted to append an attacker-controlled key to the authorized keys file, enable the local SSH service, and open a reverse SSH tunnel back to attacker infrastructure. The code was written for Windows, macOS, and Linux. Because extensions run with the same permissions as the IDE, the code could potentially reach local files, source code, and developer tooling.

Capabilities and reconnaissance

The malware gathered host and user details such as hostname, username, operating system, architecture, home directory, working directories, configured Git email, and public IP address. It also collected the names of environment variables. Phorian said this let the operator quickly gauge which machines held cloud credentials and API tokens, probably to prioritize follow-up attacks against the most valuable targets.

For persistence, the code tried to use a LaunchAgent on macOS and a scheduled task running as SYSTEM on Windows, with a startup-script fallback. Background scripts retried the tunnel about every 60 seconds. Status and host data were sent by HTTP POST to a beacon endpoint on port 8099.

Cursor noted that errors in the malicious code meant the SSH step would fail except in unusual cases, such as Cursor running with administrator privileges. Phorian likewise found bugs affecting the Windows and macOS payloads. Even so, it warned that the malware remained a serious threat because it established persistence and reported reconnaissance data to the operator.

Response and open questions

Cursor worked with the cloud provider hosting the command server so that infected machines could no longer connect to it. It removed the tainted version from its marketplace and blocked further distribution. It also briefly took the VS Code marketplace offline to rotate keys, audit access controls, and verify that no other extensions had been tampered with. The marketplace has since reopened.

As of publication, Anthropic had not issued a public notice to customers, a gap Ars Technica flagged as puzzling given the potential impact. Users who installed or updated the extension from Cursor between 5:27 am ET and 4:35 pm ET on Thursday should treat their systems as affected. Anyone who updated near that period may also want to assume possible infection. Cursor and Phorian have both published indicators of compromise, including IP addresses and file hashes. A commenter on the article also noted that installing the clean version does not remove an existing infection, so affected users need to remediate their machines rather than simply update.

Industry implications

The episode highlights a growing attack surface around AI coding tools. Extensions that wrap AI assistants run inside editors with broad access to source code, credentials, and cloud tokens, which makes them attractive targets. Compromising one verified publisher account on a marketplace can reach thousands of developers within hours, especially when auto-update is on by default. The fact that the account takeover method remains undisclosed leaves other publishers and marketplace operators unable to judge whether the same weakness applies to them.

For Anthropic, the lack of public communication may become a trust issue among enterprise buyers who weigh security posture heavily when picking AI coding tools. For Cursor, the quick containment and key rotation are positives, but the incident still shows that third-party marketplaces carry reputational risk for the host platform. Teams adopting AI developer tools should consider disabling extension auto-update, pinning versions, limiting credentials exposed through environment variables, and monitoring for unexpected SSH configuration changes.