Anthropic VS code extension on Cursor backdoored for nearly 12 hours

A supply-chain compromise of Anthropic’s official VS Code extension in Cursor potentially exposed up to 5,000 developer machines, putting source code, local files, API tokens, and cloud credentials at risk. For CIOs and technology leaders, the incident underscores how trusted developer tools have become high-value attack vectors and why IT must treat AI/IDE plugins as part of the production security boundary, with stronger access controls, update governance, and incident response readiness.