Anthropic VS code extension on Cursor backdoored for nearly 12 hours
A supply-chain compromise allowed attackers to post a malicious version (2.1.313) of the Claude extension to Anthropic's official Cursor account. The backdoor remained active for nearly 12 hours before being replaced by version 2.1.314.
Key points
- Up to 5,000 users were affected by a malicious extension
- The attack was a supply-chain compromise of the official distribution channel
- The compromised version was distributed via the Cursor marketplace
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Ars Technica did the reporting; read the original for the full story.
Read the full story at Ars Technica
