The Cutoff ReportAI & startup funding, tracked daily Search

Cursor users exposed as Anthropic extension carries backdoor

A compromised VS Code extension distributed via an official account put up to 5,000 developer machines at risk.

October 31, 2026•1 min read•Based on reporting by Ars Technica

Abstract illustration of a breaking chain link

A supply-chain attack targeted developers using Cursor, an AI-assisted coding tool. Attackers gained control of Anthropic's official distribution account to release a compromised version of a VS Code extension for the Claude model.

Version 2.1.313 of the extension contained a backdoor designed to search for cloud credentials. The malicious software reached a maximum of 5,000 users who either manually installed the update or had their systems fetch it automatically.

Security experts and researchers noted that the compromised package remained available for nearly 12 hours. Anthropic eventually resolved the issue by releasing version 2.1.314.

What it means

Neither Cursor nor Anthropic has provided details on how the official account was breached. While the update has been patched, the incident highlights the risks associated with third-party AI tool extensions and the vulnerability of official distribution channels to credential theft.

Sources

https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/

This article was written and illustrated with AI assistance from the reporting credited above, and reviewed against our editorial & AI policy. Facts come only from the linked sources. Spotted an error? Tell us.

More in Security

Security/Nov 1

Binance bleeds $6.3 billion in heist but recovers most funds

Binance has replaced 90 percent of the $6.3 billion stolen in a major hacking event. The company intends to cover the remaining 10 percent of the loss.

Abstract vector illustration of a fragmented digital grid with a single orange focal point.

Security/Nov 1

Volta-Autodoxer malware exposes victims via AI data mining

Security researchers have identified a new malware strain called Volta-Autodoxer. The software utilizes AI to automate the collection of extensive victim data.

Abstract vector illustration of a digital net capturing fragmented geometric shapes.

Security/Nov 1

AI-driven malware exposes victims: New threats emerge as Binance recovers billions

Recent security breaches highlight the risks of AI-powered data theft and massive cryptocurrency heists. Meanwhile, Apple maintains a cautious approach toward integrating AI into its product line.

Abstract geometric illustration with charcoal lines and a burnt-orange circle on an off-white background

Security/Oct 31

Applebee's exposed customer data via hardcoded app password

A researcher found a database password embedded directly within the Applebee's app. This vulnerability granted open access to the personal data of the company's customers.

Abstract vector illustration of a digital lock and a breach line.