A tampered version of Anthropic’s Claude Code extension was available on Cursor’s extension marketplace for about 11 hours on Thursday, and as many as 5,000 developers may have installed it, Cursor said.

The malicious build, version 2.1.313, tried to add an attacker-controlled SSH key to a developer’s machine, turn on the local SSH service and open a reverse SSH tunnel to the attacker, according to Cursor’s disclosure. Cursor said the build was live from 2:27 a.m. to 1:35 p.m. Pacific time. Extensions in Cursor update automatically by default, so many users would have received it without clicking anything.

The code was written for Windows, macOS and Linux, Ars Technica reported on Friday. Cursor extensions run with the editor’s permissions, so an installed copy could likely reach local files, source code and developer tools.

The companies don’t agree on where the breach happened. Luke Roberts, the chief technology officer and a co-founder of the security firm Phorion, told Ars that the version came through Anthropic’s official account. “It was a supply-chain compromise where the attacker gained access to the official distribution channel,” he said. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312.” The independent researcher Kevin Beaumont also said the build went out through that account. Mr. Beaumont first wrote on his blog that Anthropic had been hacked. He later updated the post to include Anthropic’s statement that the breach was on Cursor’s side.

Felix Rieseberg, a member of Anthropic’s technical staff, put the problem on Cursor. “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops,” Mr. Rieseberg wrote on X, The Register reported. He said “a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension,” one “which we didn’t build or publish,” and that “this only impacts Cursor users.”

Cursor agrees that Anthropic didn’t build it. It hasn’t said how someone else got the build listed under Anthropic’s name. As of Friday, Anthropic had sent customers no public notice of the incident, Ars reported.

The attack mostly failed. Turning on SSH requires administrator rights, and the extension doesn’t have them on most Mac and Windows machines, Cursor said, so on those machines the attacker couldn’t have logged in through the tunnel. The rest of the code still ran. It added the key, set itself up to survive restarts and sent the attacker host details, including usernames, Git email addresses and public IP addresses, according to Phorion’s analysis as reported by Help Net Security. Phorion’s own advisory has the technical details.

Early reports didn’t agree on which marketplaces were hit. StepSecurity wrote that the build had been published to Open VSX, the open-source extension registry, and copied from there into Cursor’s store. Cursor said only its own marketplace was affected.

Cursor said it pulled the version as soon as it found it and then shut down its VS Code marketplace “out of an abundance of caution.” It also rebuilt the marketplace, rotated its keys and worked with the hosting company to take the attacker’s server offline, according to OX Security. According to Mr. Beaumont, Anthropic released version 2.1.314 several hours after the bad build appeared. Cursor said it had found no tampering in any other version and is telling users to install 2.1.314.

Removing the extension doesn’t remove the backdoor. The payload leaves separate persistence scripts on the machine. Cursor has published scripts that check for the backdoor and remove the SSH key and tunnel processes. Sophos advised anyone who installed the bad build to also rotate every credential the machine could reach. Cursor said it would contact the affected users directly.