Anthropic VS Code extension backdoored on Cursor for 12 hours
A backdoor in Anthropic's VS Code extension on Cursor exposed developers for nearly 12 hours, highlighting supply chain risks in AI development tools.
According to a report from Ars Technica, a backdoor was discovered in Anthropic's VS Code extension distributed through the Cursor platform, where it remained active for nearly 12 hours before being removed. The attack targeted developers who use the extension for AI-assisted coding, raising serious questions about the security of third-party components in development environments.
Supply chain attack on AI coding tools
The extension is part of the growing ecosystem of AI-powered development tools. Cursor is a popular code editor that integrates AI models like those from Anthropic to help developers write, review, and refactor code. The backdoor could have allowed attackers to execute arbitrary code on developers' machines, potentially stealing credentials, source code, or injecting malicious code into projects. This incident underscores the risks of relying on third-party extensions that have access to sensitive development environments.
Supply chain attacks have become a major concern in the software industry, with recent incidents targeting open-source packages and development tools. In this case, the compromise of a verified extension on a trusted platform highlights how even well-known publishers can be exploited, and how difficult it is to detect such threats before they cause harm.
What we know and what remains unclear
The source notes that it's still unknown how attackers gained access to Anthropic's verified Cursor account. This suggests that even verified publishers can be compromised, and that the trust model for extension distribution is fragile. The duration of nearly 12 hours indicates a significant window of exposure, during which users who updated or installed the extension could have been affected. Anthropic and Cursor have not yet released detailed statements, according to the report.
Developers who used the extension during that period are advised to review their systems for signs of compromise, though specific indicators have not been provided. The lack of transparency about the attack vector and the exact payload makes it difficult to assess the full impact. It also raises questions about the vetting process for extensions on platforms like Cursor, and whether automated security checks are sufficient to catch malicious code.
Implications for the developer community
This incident highlights the need for stronger security measures in AI development tools. As AI assistants become more integrated into coding workflows, they gain access to increasingly sensitive data, including proprietary source code, API keys, and internal documentation. A backdoor in such a tool could be used to exfiltrate this information or inject vulnerabilities into projects, making it a serious threat to both individual developers and organizations.
The event also serves as a reminder that supply chain security is not just about open-source dependencies but also about the tools developers use daily. Verification badges and publisher reputation are not foolproof, and attackers are finding new ways to compromise trusted channels. For developers, this means regularly auditing installed extensions, monitoring for unusual behavior, and being cautious about updates from even well-known sources.
As the investigation continues, the full scope of the backdoor remains unclear. What is certain is that this incident will likely prompt stricter security practices across AI coding platforms and a renewed focus on protecting the software supply chain. For now, developers are left with more questions than answers, and the episode stands as a stark warning about the hidden risks in the tools they rely on every day.
