Malicious update to Anthropic's Claude VS Code extension on Cursor marketplace ran for nearly 12 hours
BREACHAnthropicredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A malicious version (2.1.313) of Anthropic's official Claude VS Code extension was distributed through Anthropic's account on the Cursor marketplace, affecting at most 5,000 users. Anthropic published the fixed version 2.1.314 several hours later, and neither Cursor nor Anthropic has explained how the account was compromised. Extensions auto-update in Cursor by default, so affected users may have received the bad version automatically.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether the Claude extension in Cursor is version 2.1.313 and remove it if so.
- Update the extension to version 2.1.314 or later.
- Review Cursor's extension auto-update setting if you want to control future updates.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Ars Technica (Security)
Who and what is in it
Companies