Anthropic VS code extension on Cursor backdoored for nearly 12 hours

What happened

A malicious actor managed to backdoor Anthropic’s VS Code extension on the Cursor marketplace for almost 12 hours. During this window, the compromised extension carried unauthorized code capable of stealing developer credentials or executing malicious commands. The attack exploited Anthropic’s verified Cursor account, though exactly how the attackers gained access remains unknown.

The risk

Extending the breach through a trusted, verified account on a popular code editor marketplace drastically raises the severity. Developers often trust verified accounts implicitly, so infected extensions have a higher chance of infiltrating developer environments and gaining access to sensitive credentials or internal networks. The incident exposes weaknesses in supply chain security for AI-enhanced developer tools.

Why it matters

The incident forces a rethink about how AI tooling is vetted and distributed through marketplaces like Cursor. Trust in verified extensions takes a direct hit, raising the cost and complexity of using AI tools safely in development workflows. Builders, operators, and security teams will need to add deeper screening, monitoring, and rapid incident response capabilities for extensions sourced from third parties—even those that appear officially verified.

Who should pay attention

Developers and organizations that rely on VS Code extensions, particularly those integrating AI capabilities, should reassess their threat models and measures to mitigate supply chain attacks. Extension marketplaces need to improve account security and detection for unusual extension alterations. Security teams must prioritize tighter controls around third-party plugin access and permissions.

What to watch next

Look for updates on how Anthropic and Cursor respond to shore up account security and prevent unauthorized uploads. Expect more scrutiny on how verified accounts are managed and how quickly compromised tools can be pulled from marketplaces. Watch whether similar attacks emerge in other AI development environments or extension marketplaces as attackers exploit these supply chain weak points.

AI Quick Briefs Editorial Desk