Anthropic VS code extension on Cursor backdoored for nearly 12 hours Ars Technica