Security Breach Exposes Thousands of Developers After Anthropic’s Official Code Extension Compromised
A malicious version of Anthropic’s official VS Code extension, distributed through the Cursor platform, was active for nearly 12 hours and potentially compromised up to 5,000 developer machines. The backdoored software installed a persistent SSH tunnel and could access sensitive local files and credentials. The attack exploited a breach of Anthropic’s verified Cursor account, though the exact method remains unknown, and neither company has issued a public alert.
A malicious version of Anthropic’s official VS Code extension, labeled 2.1.313, was distributed through the Cursor platform between 5:27 a.m. and 4:35 p.m. ET on Thursday, October 29, 2026, remaining active for nearly 12 hours. This compromised build, posted under Anthropic’s verified Cursor account, potentially affected up to 5,000 developer machines, primarily through automatic updates within the Cursor IDE. The backdoored extension installed a persistent reverse SSH tunnel via attacker-controlled keys and attempted to collect sensitive system data—including hostnames, user accounts, environment variables, Git configurations, and public IP addresses—reporting this information via HTTP POST to port 8099. Despite coding flaws in the Windows and macOS versions that limited functionality, the malware still achieved persistence through scheduled tasks and LaunchAgents, posing a significant threat even if not fully operational on all systems. Cursor responded by removing the malicious version, shutting down its VS Code Marketplace temporarily to rotate keys and audit access controls, and collaborating with cloud providers to block the beaconing server. Anthropic has not issued any public alert despite the severity of the breach.
The incident represents a supply-chain attack where attackers gained access to an official distribution channel—Anthropic’s verified Cursor account—though the exact method remains unknown. This breach underscores vulnerabilities in trusted software deliv
This incident could significantly erode trust in AI-assisted development tools, particularly those with automated update mechanisms and elevated system permissions. Developers relying on trusted extensions may now question the integrity of their entire toolchain, potentially leading to increased scrutiny of software supply chains across the industry. The attack’s focus on cloud credentials and API tokens suggests it was part of a broader reconnaissance effort—possibly preceding targeted data theft or lateral movement within corporate networks. This could have ripple effects in cybersecurity practices, pushing organizations to adopt stricter update policies, sandboxing, or more rigorous vetting of developer tools. A comparable case is the 2021 SolarWinds breach, where attackers compromised a trusted software update mechanism to infiltrate government and private-sector systems; both incidents exploit the same fundamental weakness: trust in official channels. What may follow is a wave of