Cursor 平台上的 Anthropic 官方 VS Code 扩展遭植入后门近 12 小时

英文标题：Anthropic VS code extension on Cursor backdoored for nearly 12 hours

据多家机构与安全研究人员披露，Anthropic 在 AI 编程工具 Cursor 插件市场中发布的官方 VS Code 扩展遭到供应链攻击并被植入后门，存续近 12 小时。恶意版本（2.1.313）由 Anthropic 的官方认证账号直接分发，波及多达 5000 名开发者的设备，试图通过反向 SSH 隧道获取跨平台设备的持久化远程访问权限及源码凭据。目前 Cursor 与 Anthropic 均未解释攻击者如何攻破官方账号，Anthropic 亦暂未公开通报客户。该事件再次突显了 AI 开发者生态与插件供应链面临的严峻安全隐患。

打开原文相关 2 · 机会 0

中文

据多家消息来源周五报道，Anthropic 旗下 Claude 模型的一款官方扩展被植入后门，对多达 5000 名开发者的计算机造成了安全威胁。截至目前，Anthropic 尚未就该事件向客户发出警报。

AI 辅助开发工具厂商 Cursor 周五表示，遭到篡改的软件包是其市场中提供的一款 VS Code 扩展。受影响的恶意版本为 2.1.313，随后波及了“最多 5000 名用户”，这些用户推测是手动下载或由系统自动拉取并安装了该版本。据独立安全研究员 Kevin Beaumont 透露，在该版本上线 Cursor 数小时后，Anthropic 推送了 2.1.314 版本。Beaumont 以及安全公司 Phorian 的首席技术官兼联合创始人均表示，2.1.313 版本是通过 Anthropic 在 Cursor 上的官方账号发布的。目前，Cursor 和 Anthropic 均未说明攻击者究竟是如何获取该账号控制权的。

意图窃取云凭证

“这是一起供应链安全事件，攻击者获得了官方分发渠道的访问权限，”Phorian 联合创始人兼 CTO Luke Roberts 告诉 Ars，“恶意版本 2.1.313 被发布至 Anthropic 官方账号，直接取代了 2.1.312。在 Cursor 中，扩展默认会自动更新，不过用户可以在设置中修改这一行为。”Phorian 在此处披露了更多详情。

Anthropic 尚未就此事件向客户发布公开通告。

Cursor 方面表示，该恶意扩展试图通过添加受攻击者控制的 SSH 密钥、启用本地 SSH 服务并建立反向 SSH 隧道，来植入一个持久化的 SSH 后门。该代码可在 Windows、macOS 和 Linux 系统上运行。由于 Cursor 扩展继承了该集成开发环境（IDE）的运行权限，被植入后门后，攻击者一旦安装便很可能获取对本地文件、源代码以及开发工具链的访问权限。

English / 原文

An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. Anthropic so far has yet to warn customers of the incident.

The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday. The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they either downloaded it or their systems automatically fetched and installed it. Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor. So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account.

In search of cloud credentials

“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.” Phorian has more details here.

Anthropic has yet to issue public notice of the incident to customers.

Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool’s Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed.