Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Discussion overview

The thread spent less time on Claude itself than on the messy boundary between Anthropic’s official extension, Cursor’s distribution path, Open VSX, and Microsoft’s VS Code marketplace. Anthropic representatives repeatedly said its systems were untouched and that only a tampered build delivered through Cursor affected users, while the official VS Code and Open VSX channels were clean. Several readers welcomed that narrow scope, but the contradictory reports, missing version history, and pulled packages made the reassurance difficult to independently verify.

The security lesson landed harder than the attribution question. Commenters treated an extension that can touch source trees, credentials, and developer machines as a high-value supply-chain target, especially when AI coding agents are already granted broad access to repos and local tools. Some argued this is not uniquely an AI problem: any compromised extension can execute malicious code. Others said agentic coding tools magnify the blast radius because users routinely hand them sensitive code and powerful permissions. The prevailing mood was distrustful of marketplace governance and automatic updates, not panic about a proven compromise of Claude’s core service. Sarcastic claims that frontier AI should have caught the intrusion were dismissed as misunderstanding a malicious package upload that likely bypassed normal model-facing review entirely.

Points of disagreement

The sharp dispute is who actually failed: Cursor’s marketplace or Anthropic’s release credentials and distribution process. Anthropic’s account says an attacker used Cursor marketplace access to publish an unofficial, modified extension, so official builds and Anthropic infrastructure were outside the incident. Skeptics argue that inconsistent registry evidence and the vanished version leave open the possibility that an Anthropic-controlled publishing account or broader release pipeline was compromised.