Anthropic's VS Code extension on Cursor backdoored for nearly 12 hours, up to 5,000 devs exposed
Ars Technica AI · rss · 2026-10-31
Anthropic 官方 Claude 的 VS Code 扩展在 Cursor 市场被植入后门，恶意版本 2.1.313 经由 Anthropic 官方账号分发，影响最多约 5000 名开发者，时间持续近 12 小时。安全研究员 Kevin Beaumont 指出，Anthropic 在数小时后推送 2.1.314 修复版本。由于 Cursor 默认自动更新扩展，受影响用户可能在下载或自动更新时中招。攻击者如何获取官方账号控制权目前尚无解释，Anthropic 也尚未向客户发出警告。安全公司 Phorian 的 CTO Luke Roberts 确认这是一次供应链攻击：攻击者控制了官方分发渠道，并称恶意版本直接取代了 2.1.312。攻击者的目标疑似窃取云凭证。
More from coding & agent
- Running a multi-model AI agent team off one self-updating Obsidian vault — EXM7777 · 2026-10-31
- Yacine slams Opus 5.5: 'RL-maxed' model can't write good code without hand-holding — yacineMTB · 2026-10-31
- React Doctor hits 3M weekly downloads as AI-generated React code drives demand — aidenybai · 2026-10-31
- Anthropic's Claude Code now steers away from cloning games; devs push back — sytelus · 2026-10-31
- Why Finance Is the Best Beachhead for AI Agents: 25-Minute Tasks That Take 11 Days — inductionheads · 2026-10-31
- Web Monitors launches: track competitors, funding and new AI models via MCP — gaganghotra_ · 2026-10-31