Anthropic: That Claude Code extension compromise… couldn't be us

Anthropic has rejected claims that a malicious version of the official Claude Code extension published on Cursor’s marketplace was connected to any system compromise. The company released a statement after cybersecurity experts alleged the extension, which potentially infected 5,000 developers, was uploaded to Cursor’s marketplace as a result of a breach at Claudemaker Towers.

Felix Rieseberg, an Anthropic technical staff member, stated today: "We are collaborating with Cursor on this incident, but it was not a breach of Anthropic’s systems or employee laptops." A malicious actor leveraged access to Cursor’s marketplace to publish a modified copy of the Claude Code extension, which is not linked to Anthropic.

The compromised versions on Anthropic's official channels remain unaffected and only impact Cursor users. The malicious version, version 2.1.313, was initially discovered by Phorion, an EDR vendor, and was available for download for approximately 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) on Thursday. This malicious version contained a persistent SSH backdoor for Windows, macOS, and Linux.

The backdoor collected host machine and user information, attempted to establish a reverse SSH tunnel, and required admin rights for successful execution. However, the extension still forwarded collected data to the attacker and installed the persistence mechanism, so developers must investigate their instances for potential successful tunnel creation.

To remediate the issue, users must reinstall the latest version of the extension and follow Cursor's provided instructions for clearing the infection. Neither Anthropic nor Cursor commented on the method of the malicious package reaching the official marketplace.