A tampered Claude extension sat in Cursor's marketplace for nearly 12 hours
A backdoored version of Anthropic's official Claude extension reached up to 5,000 Cursor users, and how attackers got in is still unexplained.
The short version
- The bad version was 2.1.313 of Anthropic's Claude extension, posted through its official Cursor account.
- Cursor says at most 5,000 users were affected.
- Anthropic released version 2.1.314 several hours later, per researcher Kevin Beaumont.
- Neither company has said how attackers got control of the account.
- Cursor extensions update automatically by default, though users can change that setting.
Why it matters
Even an official, trusted add-on can be turned against you if attackers take over the account that publishes it. If you code in Cursor, it is worth checking which version of the Claude extension you have and watching for notices from Anthropic and Cursor.
What happened
As arstechnica.com reported, an official extension for Anthropic's Claude model was backdoored. An extension is an add-on that gives a program new abilities, and a backdoor is a hidden way for attackers to get in. This one was offered in the marketplace of Cursor, which makes AI-assisted tools for developers.
The bad release was version 2.1.313. Cursor said on Friday that it affected "at most 5,000 users," probably those who downloaded it or whose systems fetched it automatically.
How it got out
Independent researcher Kevin Beaumont and Luke Roberts, co-founder and CTO of security firm Phorian, both said the bad version went out through Anthropic's official account on Cursor. Roberts called it a supply-chain compromise, meaning attackers got into the trusted channel that delivers software rather than attacking each user separately.
He said the malicious version replaced 2.1.312. Cursor updates extensions automatically by default, so many people may have received it without doing anything. Users can change that in settings.
What is still unknown
Neither Cursor nor Anthropic has explained how attackers took over the account. According to Beaumont, Anthropic pushed a replacement, version 2.1.314, several hours after the bad one appeared.
At the time of the report, Anthropic had not warned customers about the incident.
What to do now
If you use Cursor, check which version of the Claude extension you have and whether it updated on its own. Tell your workplace's security contact if you may have been exposed.
Consider turning off automatic updates for add-ons you rely on, and remove any you no longer use.
What to watch
- How attackers gained control of Anthropic's official Cursor account.
- Whether Anthropic and Cursor issue notices to affected users.
Try it
Open Cursor's extensions list, check the Claude extension's version number, and review your auto-update setting.
Sources and links
Liked it? Say why
Add a line for other readers.
No account needed. We never show your email. Comments with links, ads or abuse are held and not shown. Your comment shows after a quick check.
Listen to the AI Wire headlines
Listen to the AI WireListen to our daily AI shows every morning: on your commute, in the shower, wherever you are
Listen to the daily showsFirst reported by arstechnica.com · Read the original. Written by the SI Agent News Desk from the reporting above.Written with AI from the source above. Every number is checked against the source. Spot a mistake? Corrections.