TechiSeek

VendorsFor Vendors

Anthropic VS code extension on Cursor backdoored for nearly 12 hours

Ars Technica AI

Anthropic VS code extension on Cursor backdoored for nearly 12 hours News

A malicious version of Anthropic's official Claude VS Code extension was distributed through Anthropic's official account on the Cursor marketplace, affecting at most 5,000 users. The compromised version, 2.1.313, superseded 2.1.312 and was replaced by version 2.1.314 several hours later.

Main capabilities

  • Background scripts retry the tunnel roughly every 60 seconds

Practical use cases

  • Because Cursor extensions run with the permissions of the IDE, the backdoored version likely would gain access to local files, source code, and developer tooling once installed

Technical specifications

  • Code was written to work on Windows, macOS, and Linux
  • Extensions auto-update in Cursor by default, but users can configure this in settings
  • Outside of highly unusual circumstances where Cursor was started with administrator privileges, the SSH key step would fail due to errors in the malicious code

Limitations

  • Bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases
Visit Site

Recommended

Supersonic airliner in doubt as company shifts to powering AI data centersSupersonic airliner in doubt as company shifts to powering AI data centersArs Technica AI Fujifilm to boost tape production 5x as AI fuels archiving demandFujifilm to boost tape production 5x as AI fuels archiving demandArs Technica AI 4 Ways to Get Your Code Back in Shape After Black Friday4 Ways to Get Your Code Back in Shape After Black FridayThenewstack CNCF Nearly Doubles Certified Kubernetes AI PlatformsCNCF Nearly Doubles Certified Kubernetes AI PlatformsCncf This Week in Programming: Microsoft's Power Fx 'Low Code' LanguageThis Week in Programming: Microsoft's Power Fx 'Low Code' LanguageThenewstack What Everyone Gets Wrong About No-CodeWhat Everyone Gets Wrong About No-CodeThenewstack Docs-as-code solutions for API teams: how to choose the right platform in 2026Docs-as-code solutions for API teams: how to choose the right platform in 2026Mintlify Mintlify Alternatives: What to Consider (and Why There's No True Substitute)Mintlify Alternatives: What to Consider (and Why There's No True Substitute)Mintlify Build a Presentation Coaching Application with Recall - Deepgram Blog ⚡️Build a Presentation Coaching Application with Recall - Deepgram Blog ⚡️Deepgram No Code Transcription: Simplifying Workflows with Deepgram and Make.comNo Code Transcription: Simplifying Workflows with Deepgram and Make.comDeepgram Redis Cloud PrivateRedis Cloud PrivateRedis Meet Zapier Central's Chrome extensionMeet Zapier Central's Chrome extensionZapier Integrate Jupyter Notebooks with GitHubIntegrate Jupyter Notebooks with GitHubThenewstack Lessons Swift Designer Chris Lattner Has Learned about LeadershipLessons Swift Designer Chris Lattner Has Learned about LeadershipThenewstack Oso Unbundles Security AuthorizationOso Unbundles Security AuthorizationThenewstack Empower Your Team with Policy as CodeEmpower Your Team with Policy as CodePulumi Pulumi Neo Now Supports AGENTS.mdPulumi Neo Now Supports AGENTS.mdPulumi Five Years of Infrastructure as CodeFive Years of Infrastructure as CodePulumi New Policy as Code Capabilities with CrossGuardNew Policy as Code Capabilities with CrossGuardPulumi Godoc: documenting Go code - The Go Programming LanguageGodoc: documenting Go code - The Go Programming LanguageGo