According to Ars Technica, the malicious version was published through Anthropic's verified account on Cursor and superseded version 2.1.312. Cursor extensions auto-update by default. Anthropic pushed version 2.1.314 several hours later. Anyone who installed or updated the extension between 5:27 am and 4:35 pm ET on Thursday should consider themselves affected.
According to Cursor, the code tries to install a persistent SSH backdoor: it adds an attacker-controlled key, enables the local SSH service and opens a reverse tunnel, on Windows, macOS and Linux. Security firm Phorion said the code also collects environment variable names, likely to inventory cloud credentials and API tokens. Bugs in the code stopped it from working in some cases on Windows and macOS.
Cursor removed the version, cut off the server the infected machines connected to, and briefly shut its extension marketplace to rotate keys and confirm no other extensions were compromised. The marketplace has reopened. Installing the new version does not clean a machine that was already compromised. At the time of the report Anthropic had not warned customers, and neither company has explained how the account was breached.