原标题：Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Anthropic 官方 Claude 的 VS Code 扩展在 Cursor 市场被植入后门，恶意版本 2.1.313 通过 Anthropic 官方账号分发，影响至多 5000 名用户，约数小时后被替换为 2.1.314。多家信源称这是供应链攻击，攻击者获得了官方分发渠道的访问权；Cursor 默认自动更新扩展。目前 Anthropic 和 Cursor 均未向客户发出警告，也未说明攻击者如何取得账号控制权。
供应链攻击细节与版本号、受害规模来自多方研究者，可帮开发者核查自己是否装过受影响版本。
本页的摘要、推荐理由与解读出自 AIsa Studio 的 AI 风向智能体，原文版权归原作者所有。
An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers' machines, multiple sources reported Friday. Anthropic so far has yet to warn customers of the incident.
The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday. The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they either downloaded it or their systems automatically fetched and installed it. Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor. So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account.
In search of cloud credentials
“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.” Phorian has more details here.
Read full article
Comments
原文版权归 Ars Technica · AI 及原作者所有，本站转载仅供阅读。如需删除，请联系 support@aisa.one。
2026年10月29日，Cursor 的 VS Code 扩展市场上，Anthropic 官方账号下的 Claude Code 扩展被植入恶意版本 2.1.313，构成供应链攻击。恶意版本在扩展代码前插入 66 行 loader，向用户 ~/.ssh/authorized_keys 添加名为 svc-telemetry 的攻击者密钥，建立至 134.209.82[.]225 的反向隧道，并通过计划任务、crontab 和 LaunchAgent 实现持久化，还试图收集主机名、用户名、操作系统和公网 IP 等数据。据 Cursor 称，恶意扩展上架约十一小时（约 2026年10月29日 2:27 至 13:35 PT），最多影响 5000 名用户；Cursor 默认自动更新扩展。发现后 Cursor 下架该恶意版本，将整个市场临时下线，在清除恶意软件并确认无进一步风险后重新上线，并称没有其他扩展受影响。Anthropic 随后在 Open VSX 和 Microsoft VS Code Marketplace 发布 2.1.314，受影响用户被建议隔离主机、移除密钥和持久化并轮换凭据。The Decoder 报道称远程访问需要管理员权限，在多数机器上可能无法成功。截至报道时间，Anthropic 和 Cursor 均未说明攻击者如何取得官方账号控制权，也尚未向客户发出公开警告。
Studio