A developer opens Cursor, an AI coding app, and the Claude Code extension updates itself. Same name. Same publisher. Anthropic's official listing.

This time, the update quietly adds a stranger's key to the computer.

For about 11 hours on October 29, a tampered version of Anthropic's Claude Code extension sat in Cursor's extension marketplace under Anthropic's real, legitimate ID. Cursor says it reached up to 5,000 users.

Nobody clicked a shady link. Nobody downloaded anything from a sketchy site. They trusted the name, the way you trust the apps on your phone that update every night while you sleep.

Anthropic says its own systems were never breached. A malicious actor "used access to Cursor's marketplace" to publish a copy it didn't build. How the attacker got that access? As of today, neither company has said.

So here's the question this story forces: we keep asking whether we can trust AI. Can we trust whatever delivers it?

Imagine a delivery locker with your bank's name on the door. Someone with a key to the locker swaps the envelope inside. You open it without a second thought, because the name is right.

That's what happened here.

The tampered extension kept working normally, so nothing looked wrong. Behind the scenes, it planted an SSH key (a login that lets someone into a computer without a password) labeled "svc-telemetry." It reported the computer's name, the user's name, their Git email and their internet address back to the attacker. It also sent the names of up to 40 settings that looked like they hold passwords, keys or cloud access. Then it set itself up to keep running after the app closed.

The attackers didn't need to break a lock. They walked through the front door wearing Anthropic's name tag.

Security researcher Ax Sharma, quoted by Help Net Security, summed it up: "Checking the publisher name doesn't help when the publisher is real."

That's the uncomfortable part. Every security tip you've ever heard says to check who an app comes from. Here, the answer was correct, and it didn't matter.

The name on an update is not a security control. The store that delivers it is. And this time, the store was the way in.

Why go after an AI coding tool? Because of where it sits.

An AI coding assistant lives right next to a company's source code, cloud accounts and the passwords that connect them. The settings this backdoor went looking for were the ones whose names include KEY, TOKEN, SECRET, PASS, AWS and GCP. Those are the keys to everything a developer touches.

And it isn't a one-off. About a week earlier, according to The Hacker News, the ready-to-run files for five versions of OVHcloud's command-line tool were swapped for password-stealing malware. That upload came through a hijacked contributor account. Same playbook: don't break in. Borrow a name people already trust.

Auto-update made it fast. Jenn Gile of OpenSourceMalware noted the bad version was "pulled very quickly," but anyone set to auto-update could have received it in the meantime.

There's one piece of luck in this story. On most Mac and Windows computers, Cursor says, the attacker couldn't actually log in through the tunnel, because switching on remote login needs admin rights the extension didn't have. But the planted key and the hidden startup scripts still landed. Researchers at Phorion, who spotted the package, warn that on a Mac the backdoor works if remote login is already on or gets turned on later.

The attacker's server is offline now. Cursor rotated its keys, rebuilt its marketplace and says it found no other tampered extensions. None of that cleans an infected machine.

When an update carries a trusted name but arrives through someone else's store, who should answer for it: the brand, the store, or the person who let it auto-update? Tell me where you land.

Identity Decoded publishes every week at identity-decoded.com