{
  "id": 17301937,
  "title": "Anthropic VS code extension on Cursor backdoored for nearly 12 hours",
  "url": "https://urgent.news/2026/10/30/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-30T21:09:54.000Z",
  "source": {
    "name": "Ars Technica",
    "slug": "ars-technica",
    "url": "https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/"
  },
  "original_language": "en",
  "account": "An official extension for Anthropic’s Claude model was compromised in the Cursor VS Code extension marketplace, potentially impacting up to 5,000 developers’ machines, according to multiple sources. Anthropic has not yet issued an official warning regarding the incident. The infected package, version 2.1.313, affected \"at most 5,000 users\" when they either downloaded it or had their systems automatically install it, as reported by independent researcher Kevin Beaumont. Anthropic released version 2.1.314 hours after the malicious version became available on Cursor. The source of the attack remains unclear, as neither Cursor nor Anthropic disclosed how the attackers gained control of the official account on Cursor. The incident represents a supply-chain compromise, where the attacker infiltrated the official distribution channel, with malicious version 2.1.313 posted to the official Anthropic account, superseding version 2.1.312. The extensions within Cursor automatically update by default, although users have the option to adjust this setting in their configuration.",
  "summary": "It's still unknown how attackers got access to Anthropic's verified Cursor account.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}