伪装成 Claude Code 的恶意扩展在 Cursor 市场传播，或影响最多 5000 名开发者

The malware, disguised as Anthropic’s Claude Code extension, was officially listed on Cursor’s marketplace and remained available for download for approximately half a day. Cursor has issued security guidance. (Source: Cursor)

PC본문_6월 Mouser (in Article)//

AD Manager | AD178089411676 //

// AD Manager | AD178089411676

A malicious extension disguised as Anthropic’s Claude Code was uploaded to the marketplace of artificial intelligence (AI) development tool Cursor on Oct. 29, local time, potentially infecting up to 5,000 developers. The extension was designed to install an SSH backdoor, prompting warnings for developers.

Cursor is a popular AI coding editor. In August 2026, SpaceX attracted attention by acquiring Cursor developer Anysphere for $60 billion. According to Stack Overflow’s 2026 Developer Survey, released in early October, Cursor accounted for 26% of the AI coding tools or AI agents used by surveyed developers.

According to Cursor, the malware masqueraded as updates to the official Claude Code extension for Microsoft’s Visual Studio Code (VS Code), under the versions Anthropic.claude-code v2.1.312 and Anthropic.claude-code v2.1.313. The malicious versions remained officially listed on the Cursor marketplace for approximately 11 hours before being discovered by security firm Phorion and subsequently removed. According to The Register, up to 5,000 developers were infected.

The malware contained a persistent SSH backdoor capable of operating across Windows, macOS and Linux. It collected information from users’ systems and attempted to establish reverse SSH tunnels. However, the scripts responsible for creating the SSH tunnels required administrator privileges on macOS and Windows. In most environments, the malware failed to obtain those privileges, preventing the connections from being established.

Anthropic engineer Felix Rieseberg said on X that the company is investigating the incident with Cursor, but that the breach did not result from the compromise of Anthropic’s systems or employees’ laptops.

Nevertheless, The Register reported that information already stolen had been transmitted to an attacker-controlled server, while mechanisms for inserting the attacker’s SSH key and maintaining malware execution after system reboots had been observed. Users who downloaded the extension therefore need to investigate and remove the threat regardless of whether the SSH tunnel was successfully established.

Cursor said it removed the malicious versions from its marketplace and blocked their distribution immediately after becoming aware of them. As a precaution, the company also temporarily suspended its entire VS Code extension marketplace. It subsequently examined other extensions for potential compromise, rotated its own keys and resumed service. Cursor added that it worked with the hosting provider of the attacker’s server to take the server offline.

According to Cursor, the malicious extension was designed to install a backdoor deep within the system immediately upon execution. Once launched, it added the attacker’s SSH public key to the user’s SSH authorized_keys file, registered hidden files through macOS LaunchAgents, Windows Task Scheduler or Linux Cron to execute malicious scripts after every reboot, and collected information including the hostname, username, operating system, working directory, configured Git email address and public IP address before transmitting it to the attacker’s server.

The malware also collected the names of environment variables. Such variables can contain API keys, authentication tokens and cloud account credentials. Cursor confirmed that environment variable names had been collected but said it could not determine whether the actual credential values stored in those variables had also been transmitted.

The possibility of subsequent access through the SSH backdoor cannot be ruled out. The Register warned that simply updating the extension to the latest version would not remove malicious scripts already installed on the system.

Cursor has published detailed response instructions and remediation scripts in an official advisory. It recommends rotating or revoking credentials and authenticated sessions that may have been accessible from infected systems, using a separate trusted device. Simply uninstalling the extension may not remove backdoors and persistence mechanisms that have already been installed.

Some industry observers raised the possibility that the malicious extension had resulted from a breach of Anthropic’s systems. Anthropic responded in an official statement that hackers had exploited permissions on the Cursor marketplace to upload counterfeit versions that Anthropic had neither created nor distributed.

Anthropic added that it was investigating the incident in cooperation with Cursor. The company said existing versions distributed through official channels remained safe and that the impact of the malware was limited to Cursor users.

However, neither Cursor nor Anthropic has yet disclosed specific details of how the malicious packages bypassed verification and were listed on the official marketplace.

Anthropic engineer Felix Rieseberg said on X that the company was investigating the incident with Cursor, but that the breach did not result from the compromise of Anthropic’s systems or employees’ laptops.