Anthropic VS code extension on Cursor backdoored for nearly 12 hours

A malicious version of Anthropic’s Claude VS Code extension (2.1.313) was distributed via Cursor’s marketplace. The compromised extension installed a persistent SSH backdoor on up to 5,000 developer machines. The backdoor allowed attackers to capture credentials and maintain remote access without user awareness. The attack exploited the official distribution channel, meaning that the malicious package appeared legitimate to users and automated update systems. For enterprise IT teams, this incident highlights the risk of third‑party extensions, especially AI‑assistant tools that run privileged code inside the IDE. The incident involved several vendors: Anthropic (the AI model provider), Cursor (the marketplace platform), Microsoft Visual Studio Code (the IDE), and indirectly the underlying operating systems and SSH services on the developer workstations. The broader industry implication is that supply‑chain attacks can now target the developer environment, a traditionally trusted zone. This undermines the assumption that code editors are safe, and forces organizations to re‑evaluate extension trust models, update policies, and endpoint visibility. The incident also underscores the need for signed‑package verification, least‑privilege access controls, and continuous monitoring of anomalous SSH activity. Failure to act can expose internal source code, enable stealthy lateral movement, and increase the attack surface for future threats.