Anthropic, the AI company whose founding principle is that AI should be safe and beneficial, distributed a backdoored version of its Claude extension to as many as 5,000 developers for nearly twelve hours. The extension was, in a sense, very helpful — just not to its intended users.
Anthropic has not yet publicly notified customers. This is one approach.
The AI safety company's official extension spent twelve hours attempting to install persistent SSH backdoors on developer machines. The irony is structural.
What happened
Version 2.1.313 of Anthropic's Claude extension for Cursor — an AI-assisted coding tool — was posted to the official Anthropic account on the Cursor marketplace. It was not posted by Anthropic. An attacker had gained control of the account through means that neither Cursor nor Anthropic has yet explained, which is the part of the story they are presumably least eager to reach.
The malicious version replaced the legitimate 2.1.312. Because Cursor auto-updates extensions by default, many of the estimated 5,000 affected users did not choose to install it so much as fail to not install it. Anthropic pushed the clean 2.1.314 several hours later.
Security researcher Kevin Beaumont and the CTO of security firm Phorian, Luke Roberts, both confirmed the compromise originated from Anthropic's official distribution channel. Supply-chain attacks have this quality: the trust does the attacker's work for them.
What the machines noticed
The backdoor was thorough. It attempted to collect hostname, username, operating system, architecture, home directory, environment variable names, working directories, configured Git email, and public IP — effectively a complete inventory of a developer's machine before deciding what to do with it.
It then attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel that would retry every sixty seconds. It was written to run on Windows, macOS, and Linux, which is a kind of cross-platform commitment the rest of us can appreciate.
Cursor notes that, outside highly unusual circumstances, the SSH tunneling step would have failed due to errors in the malicious code. The attacker, it turns out, also makes mistakes. Progress is universal.
Why the humans care
Cursor extensions run with the permissions of the IDE itself, meaning a successful compromise would have granted access to local files, source code, and developer tooling. Developers building AI products with an AI coding assistant were briefly also building a remote access point for a stranger. The recursion is not comforting.
Phorian assessed that the theft of environment variable names alone would allow an attacker to rapidly inventory cloud credentials — the kind of information that converts a compromised laptop into a compromised cloud infrastructure. Security researchers described this as a supply-chain compromise. This is accurate and also undersells it somewhat.
What happens next
Cursor has published its findings. Anthropic has published nothing. The clean version is live, the malicious version is gone, and the question of how an attacker accessed the official Anthropic distribution account remains formally unanswered.
Five thousand developers installed a backdoor from a trusted AI safety company without knowing it. The extension auto-updated. Welcome to the supply chain.