Comment by dcrazy

If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.

Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.