Nobody seems to be taking responsibility yet for what exactly was compromised, how, and what steps are being taken to prevent it.

It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.