Backdoored Claude VS Code Extension Hit Up to 5,000 Developers

A backdoored version of Anthropic's official Claude VS Code extension threatened as many as 5,000 developers' machines, and the malicious package sat on Cursor's marketplace for nearly 12 hours before a clean build arrived. Multiple sources reported the incident Friday. Anthropic, notably, has yet to warn its own customers.

The compromised package was version 2.1.313, published through Anthropic's official account on the extension marketplace of Cursor, the maker of AI-assisted developer tools. Cursor disclosed the incident in a security notice on Friday. The company said the malicious build affected "at most 5,000 users" — presumably developers who downloaded it manually or whose systems fetched it automatically.

Independent researcher Kevin Beaumont, writing at Double Pulsar, tracked the timeline: Anthropic pushed the fixed version 2.1.314 only several hours after 2.1.313 became available on Cursor. Both Beaumont and the leadership of security firm Phorian confirmed that the poisoned build went out through Anthropic's verified distribution account — not a lookalike or a typosquatted impostor.

So far, neither Cursor nor Anthropic has explained how the attackers gained control of that account. That gap matters. A hijacked official channel is the software supply chain's worst-case scenario, because the platform itself vouches for the payload.

What actually happened to developers' machines?

The malicious extension functioned as a remote access trojan, Beaumont reported, delivered to Claude developer laptops worldwide. Phorian's analysis fills in the mechanics.

"It was a supply-chain compromise where the attacker gained access to the official distribution channel," Phorian CTO and co-founder Luke Roberts told Ars Technica. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings."

That default-auto-update detail is the quiet punch of the whole affair. Most Cursor users never chose to install 2.1.313. Their editors reached out and grabbed it for them. Anyone running the prior legitimate build, 2.1.312, got silently moved onto the trojanized package unless they had deliberately switched off automatic updates.

The attackers' goal, per Beaumont's reporting, was the hunt for cloud credentials — the keys that developers routinely hold for AWS accounts, API services and internal infrastructure. A developer laptop is a high-value target precisely because it often holds broad access across a company's cloud estate.

Who said what, and who stayed silent?

The disclosure record so far breaks down like this:

• Cursor published a security notice on its blog Friday, flagging the compromise and capping exposure at "at most 5,000 users."
• Beaumont independently documented the roughly 12-hour window and the remote-access-trojan behavior.
• Phorian published its own technical analysis and confirmed the package came from Anthropic's official account.
• Anthropic has not warned customers of the incident, as of the reporting.

That silence is the part security watchers will press hardest. The remediation path — update to 2.1.314, rotate any credentials that touched an affected machine, disable auto-update if you want manual control — depends on users knowing they were exposed in the first place.

Does auto-update need a rethink?

For the developer-tools market, the incident lands awkwardly. Cursor, Anysphere's flagship product, and the broader AI-coding-extension ecosystem have made frictionless installation and silent updating a selling point. When the distribution channel itself is compromised, that convenience becomes the attack vector. Roberts' note that auto-update is a default, config-file setting is a small sentence with large implications for enterprise security teams.

Until Anthropic and Cursor explain how the official account was taken over, every auto-updated extension on every marketplace carries a question mark. The next release, 2.1.314, is clean by all current accounts — but the mechanism that betrayed 5,000 developers remains unpatched in public view.