If your team installed Anthropic's Claude Code VS Code extension on Cursor last Thursday between 05:27 and 16:35 ET, treat those machines as compromised: rotate SSH keys and cloud tokens, update to 2.1.314, and check the indicators of compromise published by Cursor and Phorion.
Anthropic's verified Cursor account pushed malicious build 2.1.313 that stayed live for nearly 12 hours, Ars Technica reports. The payload added an attacker SSH key, opened a reverse tunnel beaconing to /beacon on port 8099, persisted via LaunchAgent or a scheduled task, and inventoried environment variable names to find cloud credentials. Around 5,000 developers auto-updated into it.
What this means for a small team
Supply-chain risk now lives inside the AI stack itself. If a laptop with Cursor or Claude Code touches your leads, invoices or legal docs, it is a credential vault worth attacking. Pin extension versions, disable auto-update for anything with filesystem access, keep production tokens out of plaintext .env files, and separate the box running live client automations from the one you experiment on.
Why it matters: A verified publisher account can be hijacked for half a day before anyone reacts, so every AI dev extension must be treated as untrusted code with full access to your filesystem.
Source: Ars Technica