Anthropic VS code extension on Cursor backdoored for nearly 12 hours

Multiple sources reported Friday that an official Visual Studio Code extension for Anthropic’s Claude model was backdoored on the Cursor marketplace and threatened as many as 5,000 developers’ machines. Anthropic had not warned customers about the incident in those accounts. The company said the compromised package was available in Cursor’s extension marketplace.

• Independent researcher Kevin Beaumont and Phorian co-founder Luke Roberts said malicious version 2.1.313 went out through Anthropic’s official Cursor account and superseded version 2.1.312.
• Anthropic later pushed version 2.1.314 several hours after the bad release became available, according to Beaumont.
• Roberts called it a supply-chain compromise of the official distribution channel and noted Cursor auto-updates extensions by default unless users change settings.

• at most 5,000 users — Upper estimate of people the malicious build presumably reached by download or auto-install
• 2.1.313 — Malicious VS Code extension build posted to the official Anthropic account
• 2.1.314 — Follow-up release Anthropic pushed several hours after the compromise
• 2.1.312 — Prior official build that version 2.1.313 superseded on Cursor
• nearly 12 hours — Headline span the extension remained backdoored before the later release

Cursor makes AI-assisted developer tools and hosted the extension under Anthropic’s official account.

Reports say Anthropic had not warned customers, and neither company has explained how the official account was taken over.