Anthropic VS code extension on Cursor backdoored for nearly 12 hours

For most of Thursday, the official Anthropic VS Code extension in Cursor's marketplace was a trojan. Version 2.1.313 was pushed through Anthropic's verified account, and because Cursor extensions auto-update by default, as many as 5,000 developers may have pulled it in without lifting a finger. Cursor puts the exposure window at 5:27 a.m. to 4:35 p.m. Eastern.

The payload went after exactly what makes a developer machine valuable: it collected host details and the names of environment variables, which is a fast way to inventory cloud credentials and API tokens, and it tried to plant an attacker SSH key and a persistent reverse tunnel on Windows, macOS, and Linux. Bugs in the code kept parts of it from working in many cases. That is luck, not defense.

And as of Ars Technica's reporting, Anthropic had not publicly warned customers, and neither company had explained how the attacker got into the account.

We are bullish on AI coding tools. They are some of the clearest cases of AI doing real, measurable work. But that is exactly why this one stings. An AI coding extension is not a font pack. It runs with the permissions of the IDE, which means it sits next to source code, secrets, terminals, and deploy keys. When the official channel for that kind of software is compromised, the blast radius is every repository and cloud account those developers touch.

The mechanics here are the oldest trick in supply-chain attacks: don't break the product, become the publisher. The malicious build simply superseded the legitimate one, and auto-update did the rest. Nobody downloaded anything sketchy. They trusted a verified badge, and the badge was the attack vector.

Cursor's response, from what's been reported, looks like the right shape: it pulled the version, worked with the hosting provider to cut off the command server, and briefly shut its marketplace to rotate keys and audit access. That is credible incident handling. What we can't grade yet is the root cause, because nobody has shared it. Was it a stolen credential, a missing second factor, a compromised build system? Each answer implies a different fix, and every other publisher on that marketplace deserves to know which one it was.

Anthropic's silence is the part I'd push hardest on. A company that wants enterprises to hand agents the keys to their codebases has to model the disclosure behavior it would want from a vendor. A quiet patch release, version 2.1.314, is not a notice. Updating to the clean version does not undo persistence that may already be installed, so affected users need explicit guidance, not just a newer build.

Where this leads if it becomes normal is easy to see. As agents and AI extensions get more autonomy and more access, the distribution channels behind them become the highest-value targets in software. Default auto-update on high-privilege extensions, with no staged rollout or signing scrutiny, is a bet that publisher accounts never fall. This week that bet lost.

Supply-chain attacks through package registries and extension marketplaces have been a recurring pattern for years, because a single compromised publisher can reach thousands of machines at once. Researchers including Kevin Beaumont and a security firm whose CTO spoke to Ars confirmed the malicious version came through Anthropic's official account, and both Cursor and that firm have published indicators of compromise such as IP addresses and file hashes.