What jumps out to me is not the malware itself, but the access path. If a backdoored VS Code extension could be pushed through Anthropic’s verified Cursor account, that is the sort of failure that makes every “trusted marketplace” assumption feel flimsy. I’d be less interested in the specific SSH tunnel trick, honestly, than in how the attacker got into the distribution channel in the first place. That’s the part that still doesn’t add up.
The payload sounds like garden-variety persistence dressed up for developer workstations: collect host details, grab whatever credential material is lying around, try to plant an SSH key, beacon out, retry until it sticks. The code flaws on Windows and macOS are a small mercy, not a comfort. A broken backdoor is still a backdoor, and in a dev environment even partial success can be enough to expose source, tokens, and cloud access paths. That’s the real danger here. Not dramatic ransomware theater. Just quiet inventory theft.
I’m also struck by how much of the story is about institutional hesitation. Ars says Anthropic hasn’t publicly warned customers, and Cursor hasn’t explained how the account was compromised. If that’s accurate, it’s hard to be generous about it. In incidents like this, silence usually helps only one side. Users need to know whether to rotate keys, inspect machines, and assume secret material is burned. Even if the malicious version only affected “at most 5,000 users,” that’s still plenty of machines to start a mess that spreads beyond the initial install.
If I were running a team that used this extension, I’d treat this as a credential hygiene incident first and a malware incident second. Revoke anything that may have been exposed on affected machines, check for odd SSH state, and don’t assume replacing the extension fixes the problem. It probably doesn’t. The source’s note that the clean version doesn’t clear an infection is the important practical detail here, and it’s the one people will miss if they only skim.
What I don’t know, and what matters most, is whether this was a one-off account compromise or a sign that these marketplace distribution paths are softer than the industry likes to admit. If the former, embarrassing. If the latter, we are going to keep seeing this in different costumes.
Reference: Anthropic VS code extension on Cursor backdoored for nearly 12 hours
