Anthropic VS Code Extension on Cursor Backdoored for Nearly 12 Hours
A compromised extension carrying Anthropic's branding was distributed through the Cursor marketplace for close to twelve hours before detection and removal. The incident involved a backdoored version of the Claude-integrated VS Code extension, meaning any developer who installed or auto-updated the package during that window may have exposed their development environment to unauthorized access.
The breach did not originate from Anthropic's internal systems. Rather, the attack followed a pattern now well-established in software supply chain incidents: a trusted package identifier was targeted, a malicious version was published under it, and the extension's existing reputation carried it past initial scrutiny. The Cursor marketplace, which serves the AI-native code editor built on VS Code's foundation, became the distribution channel.
The window of exposure — roughly twelve hours — is operationally significant. Automated update mechanisms in developer tooling mean that many installations occur without explicit user action. Any developer running Cursor with auto-updates enabled during that period would have silently received the malicious build.
The backdoor's specific capabilities have not been fully disclosed at the time of writing, but extensions operating inside a development environment have access to a wide attack surface: file system contents, environment variables, API keys, authentication tokens, and active terminal sessions. For AI-integrated developer tools specifically, this includes model API credentials and any context passed to inference calls — potentially exposing proprietary codebases or internal system prompts.
This incident sits at the intersection of two compounding risk surfaces. First, the AI tooling ecosystem has expanded rapidly, and extensions bridging AI models into developer workflows have become common infrastructure for engineering teams. Second, the security review processes for AI-specific extension marketplaces have not matured at the same pace as adoption. Cursor's marketplace, like many emerging platforms, operates with a level of trust in publisher identity that sophisticated supply chain attacks are designed to exploit.
For organizations that have standardized on AI-assisted development environments — integrating tools like Claude directly into their coding workflows — this event surfaces a category of risk that many security teams have not yet formally assessed. The IDE is no longer just a text editor; it is an authenticated, networked agent with persistent access to sensitive project resources. Treating it as low-risk infrastructure is a miscalibration.
The practical response for affected teams involves auditing installed extension versions against known-good hashes for the affected window, rotating any credentials that were accessible from the compromised environment, and reviewing whether auto-update policies for AI-integrated tooling should require additional verification steps. Teams using managed developer environments should also consider whether extension sources are pinned or reviewed before deployment across engineering fleets.
At a structural level, this incident reflects a broader pattern: as AI capabilities get embedded deeper into operational tooling, the attack surface of AI-adjacent infrastructure grows accordingly. The value of compromising an AI developer extension is substantially higher than compromising a generic syntax highlighter. Credentials, model access, and proprietary context all flow through these integrations, making them targets worth pursuing with supply chain-level sophistication.
Extension marketplace security — across VS Code, Cursor, and similar platforms — will require the same scrutiny that package registries like npm and PyPI have been subjected to following high-profile supply chain attacks. The AI tooling layer has arrived at that inflection point.
Sources: — Ars Technica (https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/)