Anthropic VS code extension on Cursor backdoored for nearly 12 hours

When a supply‑chain attack hits a developer‑focused tool, the fallout ripples far beyond the immediate victims. That’s exactly what happened in late October 2026 when a backdoored VS Code extension for Anthropic’s Claude model slipped onto Cursor’s marketplace, potentially compromising as many as 5,000 developers’ machines. The incident shines a harsh light on the fragility of the “one‑click install” model that powers today’s AI‑assisted coding stacks, and it raises uncomfortable questions about how quickly the companies involved will own up to the breach.

How the malicious extension slipped through

According to the Ars Technica report, the compromised package was a VS Code extension hosted in Cursor’s marketplace. The malicious version, labeled 2.1.313, was published under Anthropic’s official account on the platform. That detail is crucial: the attacker didn’t need to create a fake profile or a rogue third‑party repo—they hijacked the legitimate distribution channel that developers already trust.

Security firm Phorian’s CTO and co‑founder Luke Roberts described the episode as a classic supply‑chain compromise, noting that the attacker “gained access to the official distribution channel.” By posting 2.1.313 directly to Anthropic’s account, the malicious code automatically superseded the prior version, 2.1.312, and was pushed to users who either manually installed the extension or relied on Cursor’s default auto‑update setting.

The technical payload: a persistent SSH backdoor

The backdoored extension was engineered to install a persistent SSH key on the victim’s machine, enable the local SSH service, and open a reverse tunnel to a server controlled by the attacker. Because Cursor extensions run with the same permissions as the IDE, the malicious code could read local files, source code, and other developer tooling once installed.

Phorian also highlighted that the code harvested variable names, giving the operator a quick inventory of cloud credentials and API tokens stored on the compromised device. That capability would let the attacker prioritize high‑value targets for follow‑up strikes, turning a single compromised workstation into a foothold for broader cloud‑infrastructure attacks.

Why the backdoor didn’t work everywhere

Despite the attackers’ ambitions, the malicious code contained bugs that limited its effectiveness on some platforms. Phorian reported that flaws in the Windows and macOS variants prevented the backdoor from functioning in certain cases. Nonetheless, the firm warned that “the malware is still a significant threat” because it still managed to install persistence and beacon host reconnaissance data back to the operator.

The cross‑platform nature of the payload—targeting Windows, macOS, and Linux—means the threat surface was broad. Even if the code failed on a subset of machines, the sheer number of developers using Cursor’s extension ecosystem makes any successful infection a serious concern for the broader software supply chain.

Response from Cursor and the race to contain

Cursor moved quickly to mitigate the breach. The company coordinated with the cloud provider hosting the reverse‑shell server to cut off the attacker’s command‑and‑control channel, removed the malicious version from its marketplace, and blocked further distribution. In addition, Cursor shut down the VS Code Marketplace temporarily to rotate keys, audit access controls, and verify that no other extensions were compromised before reopening the store.

These steps, while decisive, came after the malicious version had already been live for several hours. The window of exposure, from 5:27 am ET to 4:35 pm on Thursday, is the period during which developers who installed or updated the extension were potentially compromised. Cursor and Phorian have published indicators of compromise—including IP addresses and cryptographic hashes—to help security teams detect infections.

Anthropic’s silence and the fallout for trust

Perhaps the most striking aspect of the episode is Anthropic’s lack of public communication. The Ars Technica article notes that Anthropic “has yet to issue public notice of the incident to customers.” Neither Anthropic nor Cursor have explained how the attackers gained control of the official Anthropic account on Cursor, leaving a critical gap in the narrative that developers and security analysts are eager to fill.

This silence could erode trust in Anthropic’s brand, especially as the company positions Claude as a flagship AI model for developers. In a market where trust is a competitive differentiator, a perceived lack of transparency may push developers toward alternative models or more security‑focused tooling ecosystems.

What developers should do now

Anyone who installed or updated the Anthropic VS Code extension from Cursor during the vulnerable window should assume they are potentially infected. Both Cursor and Phorian have listed technical indicators—such as specific IP addresses and cryptographic hashes—that security teams can use to scan for compromised machines. Removing the extension, rotating SSH keys, and revoking any suspicious cloud credentials are prudent first steps.

Beyond immediate remediation, developers should reconsider the default auto‑update behavior of IDE extensions. While auto‑updates streamline feature delivery, they also open a pathway for malicious code to propagate silently. Auditing extension sources, pinning versions, and disabling automatic updates for critical tooling can add a layer of defense against future supply‑chain attacks.

Broader implications for the AI‑dev tool ecosystem

This incident underscores a growing tension in the AI‑assisted development space: the convenience of integrated, AI‑powered extensions versus the security risks of a tightly coupled supply chain. As more companies embed large language models into developer workflows, the attack surface expands. A single compromised extension can expose thousands of developers, their codebases, and the cloud resources they manage.

For the industry, the takeaway is clear: securing the distribution channels for AI‑enabled developer tools must become a priority equal to the models themselves. Companies will need to adopt stricter key management, multi‑factor authentication for publishing accounts, and transparent incident‑response communication. Until then, developers will remain the most vulnerable line of defense, tasked with balancing productivity gains against the ever‑present risk of a backdoored extension.

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: Ars Technica; arstechnica.com; Global1.News (01 November 2026).

By Nova Chen, Staff Writer