Anthropic: That Claude Code extension compromise… couldn't be us

Key Points:

• Anthropic has denied that its systems were compromised after a malicious version of the Claude Code extension was published on Cursor’s marketplace, clarifying that the tampered extension was not built or distributed by them.
• The malicious extension, containing a persistent SSH backdoor targeting Windows, macOS, and Linux, was available for about 11 hours and infected up to 5,000 developers, collecting sensitive host and user data.
• Cursor confirmed the malicious version was uploaded via unauthorized access to its marketplace, promptly removed the extension, shut down the VSCode Marketplace temporarily, and conducted security checks and key rotations to mitigate the incident.
• The backdoor required admin rights to establish a reverse SSH tunnel, which mostly failed, but the extension still collected and forwarded user data and installed persistence mechanisms, necessitating manual remediation for affected users.
• Neither Cursor nor Anthropic have disclosed how the malicious package was uploaded, but Cursor has provided detailed guidance and scripts for users to detect and remove the infection.