Anthropic's Cursor Extension Shipped Malicious Code for Half a Day

The Incident

On 30 October, a backdoored version of Anthropic's official Claude extension appeared on the Cursor marketplace, a distribution channel for AI-assisted development tools. Version 2.1.313 of the plugin carried malicious payloads and remained available for nearly twelve hours before Anthropic replaced it with a clean build.

The compromised package potentially reached up to 5,000 machines, according to Cursor. Because extensions in the Cursor environment update automatically by default, many developers likely received the tainted version without manual intervention. Users who had disabled automatic updates or who did not use the extension during that window would have avoided exposure.

At Opentechwire, we've tracked a string of supply-chain incidents targeting developer tooling over the past eighteen months. This latest breach stands out not for novel technique but for the target: a widely used extension from a frontier AI lab, distributed through an official channel that developers trust implicitly.

How the Compromise Unfolded

The malicious version was published directly from Anthropic's verified account on Cursor. That detail, confirmed by independent security researcher Kevin Beaumont and by Luke Roberts, CTO and co-founder of security firm Phorian, indicates that attackers gained control of Anthropic's credentials or session rather than exploiting a flaw in the marketplace itself.

Neither Anthropic nor Cursor has disclosed the mechanism of account compromise. Possibilities range from credential phishing and token theft to session hijacking or insider access, but without a public post-mortem the developer community is left to speculate.

Version 2.1.314 appeared several hours after 2.1.313 went live, effectively superseding the backdoored release. Anthropic has not issued a formal advisory to affected users, and as of this writing the company's status page and blog carry no mention of the incident.

What the Malware Was After

According to Phorian's initial analysis, the backdoored extension sought cloud credentials stored on developers' machines. That payload aligns with a well-established attacker playbook: compromise a tool that runs with developer permissions, exfiltrate API keys and session tokens for AWS, Google Cloud Platform, Azure, and other infrastructure providers, then pivot to production environments or data stores.

The duration of exposure, roughly half a day, gave attackers a narrow but viable window. Modern CI/CD pipelines and developer environments often cache credentials in environment variables, configuration files, or credential managers that browser extensions and editor plugins can access. A malicious extension running in VS Code or a derivative like Cursor inherits the same filesystem and process permissions as the editor itself.

We have seen this attack surface exploited before. In early 2025, a backdoored Python package targeting data scientists exfiltrated Jupyter notebook tokens. In mid-2025, a compromised Node.js package harvested AWS credentials from developers building serverless applications. The Anthropic incident follows that pattern but operates one layer higher in the stack, targeting the editor extension rather than a language-specific package manager.

The Extension Supply-Chain Problem

Editor extensions occupy a privileged position in the developer workflow. They run continuously, update silently, and often request broad permissions to integrate with language servers, file systems, and external APIs. That makes them attractive targets and effective vectors.

Cursor, a fork of Microsoft's Visual Studio Code optimised for AI-assisted coding, inherits VS Code's extension architecture. Extensions are distributed through a marketplace, versioned, and signed, but the trust model hinges on account security. If an attacker compromises the publisher's account, they can push malicious updates to every installation that has enabled automatic updates.

Microsoft's VS Code marketplace has faced similar incidents. In 2024, a compromised publisher account was used to distribute a keylogger disguised as a popular theme. In that case, the malicious version remained live for less than six hours before Microsoft intervened. The Anthropic incident on Cursor lasted nearly twelve hours, suggesting that detection and response mechanisms may be less mature on the smaller platform.

The broader lesson is that extension marketplaces, like package registries, are single points of failure. A compromised account can turn a trusted tool into a distribution channel for malware, and the automatic update behaviour that keeps developers secure against known vulnerabilities also ensures rapid propagation of malicious code.

What Developers Should Do

If you installed or updated the Anthropic Claude extension for Cursor between late 29 October and early 30 October, assume compromise. Rotate all cloud credentials accessible from your development machine: AWS access keys, GCP service account keys, Azure tokens, GitHub personal access tokens, and any API keys for third-party services.

Check your cloud audit logs for unusual activity during and immediately after that window. Look for API calls from unfamiliar IP addresses, regions, or user agents. Pay particular attention to credential enumeration (ListBuckets, DescribeInstances, ListUsers) and data exfiltration (GetObject, DownloadBlob).

Review your Cursor extension update history. On macOS and Linux, extension metadata is stored in ~/.cursor/extensions. On Windows, it lives in %USERPROFILE%\.cursor\extensions. If version 2.1.313 appears in your logs, treat your machine as compromised and follow your incident response protocol.

Consider disabling automatic extension updates in Cursor and other editors. The trade-off is manual vigilance, but in high-stakes environments that may be preferable to silent, unvetted updates. You can configure this in Cursor's settings under Extensions > Auto Update.

The Silence from Anthropic

As of 31 October, Anthropic has not published a security advisory, incident report, or user notification regarding the compromised extension. That silence is striking. Developers who rely on the Claude extension for code generation, refactoring, and documentation have a right to know whether their credentials were at risk and what steps the company is taking to prevent recurrence.

Transparency after a supply-chain incident is not just good practice; it is a trust signal. The absence of disclosure leaves the community dependent on third-party researchers and security firms for details, and it undermines confidence in the tooling.

We reached out to Anthropic for comment but had not received a response by publication time.

Implications for AI Tooling Security

The incident arrives as AI-assisted development tools are being adopted at scale across enterprises and startups. Cursor, GitHub Copilot, Tabnine, Codeium, and a dozen other platforms now sit inside the inner loop of software development, with access to source code, credentials, and production systems.

That makes them high-value targets. A successful compromise of an AI coding assistant can yield access to intellectual property, infrastructure, and customer data across thousands of organisations simultaneously. The attack surface is large: the editor extension, the cloud API, the model weights, the training data pipeline, and the authentication layer.

We expect to see more incidents of this kind. As AI tooling matures, adversaries will shift from opportunistic attacks on individual developers to systematic targeting of the platforms themselves. Supply-chain security, already a hard problem in open-source ecosystems, becomes harder still when the supply chain includes closed-source models, proprietary APIs, and opaque update mechanisms.

The Anthropic incident is a reminder that trust in AI tools must be earned continuously, not assumed. Developers should treat extensions, plugins, and integrations with the same scepticism they apply to third-party dependencies, and platform providers must invest in account security, anomaly detection, and rapid incident response.

For now, the affected extension has been replaced, but the questions remain: how did attackers gain control of Anthropic's account, what data did they exfiltrate, and what safeguards will prevent the next compromise?