Ars Technica reports a malicious version of Anthropic's VS Code extension reached Cursor users, with an install window of roughly 11 hours and at most 5,000 users affected. Earlier research showed Claude Code's Auto Mode can be hijacked. Both point to isolation.
On Thursday 29 October 2026, a malicious version of Anthropic's VS Code extension was published to Cursor's marketplace. Ars Technica reported it on 30 October. Cursor said version 2.1.313 affected "at most 5,000 users." Anyone who installed or updated the extension between 5:27 am ET and 4:35 pm that day should consider themselves affected, according to the report.
Two months earlier, on 26 August 2026, the researcher behind Embrace The Red published research describing how Claude Code in Auto Mode can be steered into running attacker code. The two stories are unrelated in cause. Together they describe one problem: AI coding tools run with the developer's privileges, and the controls around them are weaker than the access they hold.
What happened with the extension
The malicious version went out through Anthropic's official account on Cursor. Independent researcher Kevin Beaumont said Anthropic pushed version 2.1.314 several hours later. Luke Roberts, CTO and co-founder of security firm Phorian, called it a supply-chain compromise in which the attacker gained access to the official distribution channel. He added that extensions auto-update in Cursor by default, though users can change that in settings.
Neither Cursor nor Anthropic has explained how the attackers got control of the account. Ars reports that Anthropic had not issued a public notice to customers and that neither company answered its questions.
According to Cursor, the extension tried to:
- Collect host and user details: hostname, username, OS, home directory path, environment variable names, working directories, Git email and public IP.
- Add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel. Cursor said this step would fail except in unusual cases where the tool ran with administrator privileges, because of errors in the malicious code.
- Make the tunnel persistent through a LaunchAgent on macOS or a scheduled task on Windows, retrying roughly every 60 seconds.
- Report back by HTTP POST to /beacon on port 8099.
Phorian said that collecting environment variable names let the operator inventory cloud credentials and API tokens on a machine, probably to pick targets for follow-up attacks. Bugs in the Windows and macOS code stopped the backdoor working in some cases. Phorian still called it a significant threat, since it installs persistence and sends reconnaissance back to the operator.
Cursor said it worked with the hosting provider to cut off the server, removed the bad version, and closed the marketplace to rotate keys, audit access controls and check other extensions. The marketplace has reopened.
According to Ars, because Cursor extensions run with the permissions of the IDE, the backdoored version likely would gain access to local files, source code and developer tooling once installed.
That is Ars's assessment of the exposure, hedged as "likely," and it is the point for a security team. An extension is not a sandboxed app. It is code that can run with your developer's access.
The Auto Mode research
Auto Mode replaces human approval prompts with a safety classifier. The researcher says it has been the default starting mode in Claude Code since mid-August. He reports a chain in which a request to summarize a website leads Claude to fetch a ZIP archive, decline to run a bundled binary, write its own Python decoder, and run it inside the extracted folder. A malicious struct.py in that folder shadows Python's standard module when base64 is imported, and the attacker's code runs.
He reports success in 3 of 5 runs for one variant and up to 4 of 5 for another, and says these are small samples, not a universal rate. Treat them as one researcher's results.
The contrast he draws is with a vendor claim. He says Boris Cherny of Anthropic posted that layered defenses could reduce indirect prompt injection on unseen attacks to approximately zero, and shared a chart from a test by a vendor, Trajectory Labs, showing 0.00% attack success for Opus 5 in Auto Mode across 72 scenarios run ten times each. The researcher describes that evaluation as commissioned by Anthropic. His chain was not in that set. In his words, both the benchmark and a working exploit can be true at once.
He says Anthropic closed his report as Informative and that the behavior was working as designed. As he relays it, Anthropic's position is that Auto Mode is a convenience feature backed by a best-effort classifier, not a security guarantee, and that the real boundary is OS isolation and network egress control. That is his account of the response, not a published Anthropic statement.
What the two stories share
The extension incident shows that a trusted publisher account can ship hostile code to machines that auto-update. The Auto Mode research shows that an approval classifier can be walked around by a chain of individually harmless steps. In both cases the damage depends on what the developer account can reach: SSH, cloud credentials, tokens, source.
The open questions are specific. How does your organization decide which extensions may be installed, who pins versions, and are auto-updates on? Which machines hold long-lived cloud credentials in environment variables or files? Is any agent permitted to run commands without a human approving them, and if so, where?
What this means for your roadmap
This week, check whether anyone who installed Anthropic's VS Code extension from Cursor on 29 October falls into the affected window, and use the indicators of compromise Cursor and Phorian published. Then set policy: pin extension versions or disable auto-update on developer machines, keep long-lived cloud credentials off workstations, and run coding agents in isolated environments with restricted network egress. In regulated environments, decide in writing whether auto-approval modes are allowed at all. A classifier is not a boundary.
Sources
- Ars Technica Anthropic VS code extension on Cursor backdoored for nearly 12 hours · 30 oct 2026
- embracethered.com Breaking Claude Code Opus 5 Auto Mode · Embrace The Red · 27 ago 2026
This briefing was researched and written by SKYLOGIQ's editorial pipeline: an AI writer and an AI fact-checking editor, with a human review queue for anything the editor refuses. Sources are listed above. How the Briefing is made