Version 2.1.313 of Anthropic’s Claude Code extension for VS Code and Cursor contained a remote-access trojan, according to security researcher Kevin Beaumont, and Cursor has confirmed an incident involving the same version on its marketplace. Cursor says about 5,000 developer PCs were affected. A fixed release is out, but installing it does not remove a backdoor that was already planted, so affected machines need to be checked by hand.
| Item | Detail |
|---|---|
| Affected version | Claude Code extension 2.1.313 (VS Code and Cursor) |
| Replacement | 2.1.314 replaced the malicious version |
| Impact stated by Cursor | About 5,000 PCs |
| Key risk | Updating does not remove an existing backdoor |
What happened
Beaumont described the 2.1.313 build as a supply-chain attack, meaning malicious code that reaches users through software they already trust. Cursor, the AI code editor built on VS Code, acknowledged the incident in a security notice. Cursor said Anthropic did not create the malicious version. Beaumont, however, pointed out that the file was uploaded through Anthropic’s verified publisher account.
His analysis describes two stages. First, the malware sent the infected machine’s details to an attacker-controlled server: device name, login account, OS and CPU type, home folder location, the working folder, the list of registered environment variables, and the Git commit email. Second, it opened an outbound SSH tunnel from the PC, which let the attacker pick a machine and operate its terminal directly. The attacker’s server was later found to be offline.
Why it matters
The extension updates itself automatically, so a user could have received the malicious version without doing anything. Developer machines typically hold source code and many access keys. If someone gains a remote terminal there, the damage can spread to a company’s wider systems.
Recovery is the harder part. 2.1.313 was taken down and 2.1.314 was published in its place. But Beaumont found that after the swap, the existing backdoor and data collection stayed in place and SSH connection attempts continued. Each affected machine therefore has to be cleaned up manually.
Beaumont also said Anthropic quietly pulled the malicious version without announcing the incident and did not answer his questions. He has called for the company to explain what happened.
Background and context
Reports on the scope of the damage conflict. Security firm Phorion published an advisory preview saying it found a persistent SSH backdoor targeting macOS, Linux and Windows in the build distributed through Open VSX, an open-source extension marketplace. Other accounts say only the Cursor marketplace was affected. There is still no evidence on whether the build on Microsoft’s official marketplace was infected.
| Question | What is known so far |
|---|---|
| Cursor’s statement | About 5,000 PCs affected |
| Beaumont’s claim | Possibly distributed to millions of PCs (an estimate based on install counts) |
| Microsoft marketplace | Infection not confirmed |
Beaumont also said he confirmed that Binance, the crypto exchange, uses this extension in Cursor. That shows only that the extension was in use. No actual infection, or link to any other incident, has been confirmed.
What to do now
If you use the Claude Code extension, it is worth checking your setup now.
- Check whether 2.1.313 appears in your install history. If it does, do not treat updating as the end of the job.
- Look for unfamiliar SSH connections or background processes.
- Rotate the API keys, tokens and SSH keys stored on the development machine.
- Review your team’s auto-update policy for extensions.
The next thing to watch is an official explanation from Anthropic. Until it says how the verified account was abused, and how far the real damage extends on each marketplace, questions about trust in the wider AI coding tool ecosystem are likely to remain open.
