# Anthropic VS Code Extension on Cursor Backdoored for Twelve Hours

Source: TechNewsList (https://technewslist.com)
Canonical URL: https://technewslist.com/en/article/anthropic-vs-code-extension-on-cursor-backdoored-for-twelve-h-2026-10-31-morning
Section: Software (https://technewslist.com/en/software)
Author: TechNewsList
Language: en
Published: 2026-10-31T05:54:44.28+00:00
Updated: 2026-10-31T06:27:37.540207+00:00

> Security researchers identified a rogue lookalike extension on Cursor's marketplace that harvested developer credentials for nearly 12 hours.

## TL;DR
- A rogue extension impersonating Anthropic Claude remained accessible on the Cursor IDE extension registry for almost 12 hours.
- The malicious code was engineered to harvest environment variables, local auth tokens, and cryptographic keys from workstations.
- Security analysts traced the attack to weak namespace verification protocols in third-party developer tool directories.
- The incident illustrates the severe supply chain risks associated with AI-powered code editors and unverified extension registries.

## Key points
- Threat actors registered a typosquatted package mimicking the official Anthropic Claude extension on the popular Cursor IDE platform.
- Upon activation, the background payload executed silent reconnaissance, scouring developer machines for .env files and cloud credentials.
- Exfiltrated data was transmitted via encrypted HTTPS requests to disposable command-and-control servers before community discovery.
- Cursor and Visual Studio Code marketplace architectures face mounting pressure to implement mandatory cryptographic publisher signing.
- Development organizations are auditing internal engineering laptops for credential leakage and revoking production API tokens.

## What happened

In a chilling demonstration of software supply chain vulnerability targeting modern developer environments, cybersecurity researchers discovered that a malicious extension impersonating Anthropic's official Claude assistant operated undetected on the Cursor IDE extension marketplace for nearly twelve hours. Before being identified and purged from the registry, the rogue package was downloaded and installed by thousands of software engineers seeking to integrate Anthropic's latest frontier models into their local coding workflows.

Detailed forensic decompilation of the extension bundle revealed that while the package provided functional code completion to maintain user credibility, its background activation scripts initiated an automated credential-harvesting sequence. The malicious code systematically scanned local developer file systems for sensitive configuration files—including environment variables (.env), AWS credentials, GitHub personal access tokens, and private SSH keys—packaging the stolen secrets into encrypted payloads and exfiltrating them to external infrastructure.

## Why it matters

Developer workstations represent the crown jewels of enterprise cybersecurity architecture. Unlike production cloud servers, which are heavily fortified with immutable container configurations, intrusion detection agents, and strict egress firewalls, software engineers' local laptops routinely possess elevated administrative privileges and direct access to source code repositories and production deployment pipelines. When a local developer workstation is breached, the entire downstream deployment topology becomes immediately vulnerable to lateral movement.

![Advanced technology compute module symbolizing software development.](https://technewslist.com/storage/v1/object/public/media/api/1793428053181-ujdxt8-anthropic-vs-code-extension-on-cursor-backdoored-for-twelve-h-2026-10-31-morning-inside-1-3eb9a57654.webp)

As AI-integrated code editors such as Cursor, Windsurf, and Visual Studio Code become ubiquitous across the software engineering industry, developer reliance on third-party marketplace extensions has exploded. Attackers recognize that compromising a single widely adopted development extension grants direct, unauthenticated access into hundreds of corporate codebases, enabling downstream supply chain compromises that dwarf traditional corporate network penetrations. The Cursor marketplace incident proves that extension directories have become primary offensive battlegrounds where subtle typosquatting vectors bypass traditional perimeter defenses.

## Technical details

The technical vector utilized in the breach leveraged namespace typosquatting combined with lax publisher identity verification protocols. While Microsoft's official Visual Studio Code marketplace enforces certain publisher domain verification standards, alternative and fork-based code editors often synchronize with public Open VSX registries or maintain proprietary marketplace mirrors that lack rigorous publisher domain ownership validation.

The attackers registered a publisher identifier that closely mirrored Anthropic's verified branding, utilizing zero-width Unicode characters and subtle character substitutions to deceive developers inspecting extension metadata. Upon installation, the extension's package.json executed an immediate post-install Node.js script. The script traversed common developer directories, querying standard configuration paths used by Docker, Kubernetes (kubeconfig), and cloud command-line interfaces. Stolen secrets were staged in memory, encrypted using an ephemeral AES-256 key, and transmitted via standard outbound HTTPS POST requests masquerading as legitimate diagnostic telemetry. Furthermore, the malware established persistent cron tasks to re-scan directories upon subsequent reboots, ensuring continuous exfiltration.

![Cryptographic locks and digital credentials illustrating security defenses.](https://technewslist.com/storage/v1/object/public/media/api/1793428053930-en5749-anthropic-vs-code-extension-on-cursor-backdoored-for-twelve-h-2026-10-31-morning-inside-2-72e267b268.webp)

## Market / industry impact

The disclosure has prompted immediate emergency security advisories across enterprise software engineering departments. Security teams at major technology companies, financial institutions, and defense contractors issued urgent internal mandates directing software engineers to inspect local extension manifests, purge unauthorized marketplace packages, and execute widespread credential rotation across all development environments and production cloud accounts.

Furthermore, the breach is forcing AI editor developers to fundamentally reconsider marketplace governance. Cursor leadership issued an apology to the community, announcing the immediate rollout of mandatory cryptographic publisher verification, automated static analysis scanning for all newly published extension releases, and sandboxed extension runtime permissions that restrict file system access. The broader developer tooling ecosystem is transitioning toward zero-trust developer environments where IDE extensions cannot access workstation secrets without explicit per-directory user authorization.

## What to watch next

Cybersecurity regulatory authorities and the Cybersecurity and Infrastructure Security Agency are expected to incorporate developer marketplace security into upcoming federal software supply chain guidelines. Enterprise software procurement leads will increasingly demand verifiable software bills of materials not just for deployed applications, but for the entire developer toolchain used to build them.

In addition, security operations centers will closely monitor underground cybercrime marketplaces for compromised corporate credentials harvested during the twelve-hour intrusion window. As AI-accelerated programming reshapes how software is authored, ensuring that the development tools themselves remain secure from supply chain poisoning will determine the foundational integrity of future digital infrastructure.

## Sources

- Ars Technica Cybersecurity Desk: https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/
- Decrypt Investigation Desk: https://decrypt.co/382268/secret-service-fbi-binance-hack-probe
- Ars Technica Consumer Telematics: https://arstechnica.com/cars/2026/10/gm-to-pay-220-million-after-selling-customer-smart-driver-data/

Mentions: Anthropic, Cursor IDE, Visual Studio Code, Supply Chain Security, Developer Workstations

## Sources
- [Ars Technica Cybersecurity Desk](https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/)
- [Decrypt Investigation Desk](https://decrypt.co/382268/secret-service-fbi-binance-hack-probe)
- [Ars Technica Consumer Telematics](https://arstechnica.com/cars/2026/10/gm-to-pay-220-million-after-selling-customer-smart-driver-data/)