A malicious version (2.1.313) of the official Anthropic Claude VS Code extension was uploaded to the Cursor marketplace, replacing the prior 2.1.312 release. The package appeared under Anthropic’s verified account, and Cursor’s default auto‑update setting meant the compromised code could have been installed on up to 5,000 developer workstations before a clean 2.1.314 version was pushed.
What Changed in the VS Code Extension Supply‑Chain
The only difference between the legitimate and malicious releases is the inclusion of a backdoor in version 2.1.313. The attacker leveraged Anthropic’s official distribution channel on Cursor, effectively hijacking the supply‑chain for that extension. The malicious package was available for a short window before the corrected version (2.1.314) replaced it.
Why the Incident Matters to AI and DevOps Engineers
Engineers who rely on AI‑assisted tooling expect the official extension to be trustworthy. A supply‑chain compromise of this nature can introduce hidden code that searches for cloud credentials or other sensitive data, potentially giving an attacker foothold in development environments. The scale—affecting thousands of machines—demonstrates how quickly a compromised extension can propagate when auto‑updates are enabled.
Operational and Security Implications
- Auto‑update defaults: Cursor automatically applies new extension versions unless users explicitly disable the feature.
- Version pinning: Without pinning to a known good version, developers may unintentionally accept malicious updates.
- Distribution account security: The breach highlights the need to protect the credentials that manage official extension publishing.
- Supply‑chain monitoring: Continuous verification of extension hashes or signatures can detect unexpected changes.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Immediately audit any installed Anthropic Claude extensions in Cursor and verify the version number. If 2.1.313 is present, revert to 2.1.312 or the newer 2.1.314, and consider disabling automatic updates for critical extensions. Rotate any cloud credentials that may have been exposed and review logs for anomalous activity. Finally, incorporate supply‑chain checks—such as hash verification or signed releases—into your CI/CD pipeline to reduce reliance on implicit trust in marketplace distribution channels.
