VS Code Extension for Anthropic's Claude Model Backdoored, Affecting Thousands of Developers

A VS Code extension for Anthropic's Claude model was backdoored, creating a significant security breach that potentially impacted up to 5,000 developers' machines. The malicious version of the extension, 2.1.313, was designed to install persistent SSH backdoors, allowing attackers to gain control over the affected systems. This incident highlights the critical nature of software extensions and the potential risks they pose when distributed through official channels.

According to reports, the attack involved gaining control of Anthropic's official account on Cursor, a platform for managing VS Code extensions. The distribution of the malicious extension lasted approximately 11 hours on October 29, affecting developers using Windows, macOS, and Linux operating systems. During this period, the attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, which executed without requiring any user interaction.

The malicious code collected system and user information, added an attacker-controlled SSH key, and attempted to enable SSH access. Persistence was achieved through macOS LaunchAgent or Windows scheduled task/Startup script, ensuring that the backdoor remained active even after the initial infection. Host details and backdoor status were sent to the attacker’s server at IP address 134.209.82.225, providing valuable insights into the affected systems.

Despite these sophisticated maneuvers, coding errors in the malware's SSH setup routines likely prevented full access to many affected systems. However, the malware could still send reconnaissance data even if the SSH backdoor failed, allowing the attackers to gather crucial information about the targeted machines. In response to the incident, Cursor removed the malicious extension and shut down its marketplace temporarily to prevent further infections.

It is worth noting that no evidence was found that other extension versions or official distributions were affected. Affected users are advised to check for the 'svc-telemetry' SSH key on their machines as part of the remediation process. Additionally, impacted users should isolate their machines, rotate secrets, invalidate sessions, and rebuild their environment to ensure complete security. The distribution timeframe for the malicious extension was between 2:27 a.m. and 1:35 p.m. Pacific Time, indicating a relatively narrow window for the attack to occur.

While the exact method by which the attackers managed to publish the malicious extension under Anthropic's name remains unclear, questions also arise regarding whether Cursor or Anthropic's systems were compromised during the incident. Furthermore, it is notable that Anthropic has not issued a public notice to its customers about the incident, leaving some uncertainty around the impact on their operations and future security measures.

What we know

• - A VS Code extension for Anthropic's Claude model was backdoored. ¹²
• - Up to 5,000 developers' machines were potentially affected. ¹²
• - The malicious version of the extension was 2.1.313. ¹²
• - The extension was designed to install persistent SSH backdoors. ¹²
• - The attack involved gaining control of Anthropic's official account on Cursor. ¹
• - The backdoored extension worked on Windows, macOS, and Linux. ¹
• - The distribution of the malicious extension lasted approximately 11 hours on October 29. ²
• - Attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file. ²
• - The malicious code executed without requiring user interaction. ²
• - The extension collected system and user information, added an attacker-controlled SSH key, and attempted to enable SSH access. ²
• - Persistence was achieved through macOS LaunchAgent or Windows scheduled task/Startup script. ²
• - Host details and backdoor status were sent to the attacker’s server at IP address 134.209.82.225. ²
• - Coding errors in the malware's SSH setup routines likely prevented full access to many affected systems. ²
• - The malware could still send reconnaissance data even if SSH backdoor failed. ²
• - Cursor removed the malicious extension and shut down its marketplace temporarily. ²
• - No evidence was found that other extension versions or official distribution were affected. ²
• - Impacted users should check for 'svc-telemetry' SSH key on their machines. ²
• - Remediation includes isolating machines, rotating secrets, invalidating sessions, and rebuilding the environment. ²
• - Only Cursor was distributing the malicious extension; npm, Open VSX, and Microsoft's Visual Studio Code Marketplace were not affected. ²
• - Questions remain about how the attackers published the malicious extension under Anthropic's name and if Cursor or Anthropic's systems were compromised. ²
• - Anthropic has not issued a public notice to customers about the incident. ¹
• - The distribution time frame was between 2:27 a.m. and 1:35 p.m. Pacific Time. ²