Anthropic VS code extension on Cursor backdoored for nearly 12 hours

AI coding tools now carry the same software supply-chain risks as any other privileged developer dependency. An Anthropic VS Code extension distributed through Cursor was reportedly backdoored for nearly 12 hours through Anthropic's verified Cursor account. The verification badge made the malicious release appear legitimate, while the method attackers used to gain access remains unknown. Teams that installed or updated the extension during the affected window should treat their development environments as potentially compromised: identify the installed version, remove it, rotate credentials accessible from the editor or terminal, and review network and repository activity. The incident is also a reminder that marketplace verification is not proof of package integrity. Builders should pin extension versions where possible, restrict automatic updates, monitor publisher and permission changes, and include IDE plugins in dependency inventories and incident-response plans.