Is this affecting only people using Cursor or all VS Code users? The article specifically mentions the Cursor marketplace. But the affected version is indeed missing on the official VS Code marketplace, was it compromised too?
VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
You could also start whichever container it needs (the docker work) yourself and just have the two containers container with eachother (e.g. docker compose, without granting access to docker socket), provided that the docker work is static enough that this would work.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.
Is this affecting only people using Cursor or all VS Code users? The article specifically mentions the Cursor marketplace. But the affected version is indeed missing on the official VS Code marketplace, was it compromised too?
How will they communicate and fix that. The affected version has been yanked from the marketplace: https://marketplace.visualstudio.com/items?itemName=anthropi... but that doesn't clean up infected machines.
Seemingly the won't to either point.
Some more details
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
The extension has over 27 million installs, ouch
VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
You could also start whichever container it needs (the docker work) yourself and just have the two containers container with eachother (e.g. docker compose, without granting access to docker socket), provided that the docker work is static enough that this would work.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.
Try smolvm microvms from https://smol-machines.com