> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What
a joke the company had become under Elon. But also it might be related to
Anthropic/SpaceX business ties, they try to minimize damage on Anthropic
pre-IPO
Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and Anthropic had never released a "Cursor Plugin"
This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.
I just built a retro OS for ESP32’s so that I can write BASIC programs and plop them on microcontrollers. My first ESP32 was a wrist watch. My second is a distraction free writer.
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize
(official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX
account with release privileges.
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.
Yeah OpenVSX security is a joke, they also have dumb search algorithm which
allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim
their proprietary VSCode marketplace to be more secure.
Vscode(ium) extensions are also pretty weak security wise in general. There's little guardrails on what an extension can do.
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.
There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no
good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.
Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use Claude, Codex and Cursor/SpaceX agents, and Cursor comes very convenient to have all three in a single interface. Also I still code manually especially when prototyping, so having an IDE helps with it as well. I knew about OpenVSX situation with the search, so when installing extensions I always did triple-checking to verify the extension being really submitted by upstream and not by squatter; but now given upgrades can also deliver a compromise I am thinking of developing an extension that will act in similar manner to pnpm minimum release age.
Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.
The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
This is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.
My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless
My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.
If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.
now I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.
> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
Nah it was Anthropic, see my comment at https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi...
Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under Elon. But also it might be related to Anthropic/SpaceX business ties, they try to minimize damage on Anthropic pre-IPO
Direct link to Binance assertions you mentioned [0]
The Binance post should probably be the root link for this topic not this blog post - IMO
[0] https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Wasn’t it called Cursor Marketplace pre-Elon?
Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and Anthropic had never released a "Cursor Plugin"
Cursor didn’t always use Open VSX, it changed in late 2025. https://forum.cursor.com/t/extension-marketplace-changes-tra...
Also worth noting that it doesn’t use Open VSX directly but uses a cursor hosted mirror at https://marketplace.cursorapi.com/open-vsx-mirror
Thanks for correction!
From "I suspect it was Anthropic" to "Nah it was anthropic", it's amazing how disinformation spreads... when even your source says:
> but it is unclear whether his account or another part of the publishing process was compromised.
God, people get so conspiratorial on HN when it comes to Ant
Cursor reporting this: https://cursor.com/blog/claude-code-extension-security-notic...
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Why didn't Claude detect the hack and prevent it from affecting customers using its superhuman AGI reasoning?
This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
> someone got the credentials
> No review system at anthropic has seen this
Weird flex
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
Arguably, your security shouldn't stop at internal code review and should aim at covering things that are pushed to your users.
They weren't using last minutes model, which is totally better than last hours model which would have totally detected this, pinkie swear.
Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.
(This is a joke, to be clear.)
Somehow bullish if anthropic spins this as Claude's own doing
Damn, thank you for that.
Sums up my feelings of the last few years nicely.
Don't worry, I assume an LLM version of McAfee Total Protection Antivirus is coming soon
I do have a log reading / action / resolution product in the works.
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.
That's cute but bill for going thru even tens of log lines per second gonna be more expensive than entire rest of the infrastructure.
I love how LLMs have brought DIY software back. Need an app? Just make it. Like back when you’d write programs in BASIC
I just built a retro OS for ESP32’s so that I can write BASIC programs and plop them on microcontrollers. My first ESP32 was a wrist watch. My second is a distraction free writer.
It’s good fun building for retro-like machines.
This is where I silently found gold. All those old TODO when if I have time in retirement
I've got a whole heap of unfinished side projects that I'm digging through
I’ve set up something like that with Opus. Works well enough, and points out CVEs to fix on the regular.
Running NixOS helps.
I've set up something like that with a small local model in my homelab.
It was safety-contrained from being able to realize its full potential.
You’re absolutely correct, and I owe you a honest statement—it was a hack, and here’s the kicker: *I failed to catch it, and that’s on me.*
Here’s a complete rundown of what happened—load-bearing parts first:
It wasn't Anthropic that was hacked but SpaceXAI (their Cursor Marketplace).
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...
This could have been avoided by having extensions signed by company doing them with keys and review
Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim their proprietary VSCode marketplace to be more secure.
Vscode(ium) extensions are also pretty weak security wise in general. There's little guardrails on what an extension can do.
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.
Then why even allow employees to use that?
Binance got a pretty expensive lesson if that was the cause for their recent hack
There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.
Why not use claude code directly?
Why risk getting compromised like that?
Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use Claude, Codex and Cursor/SpaceX agents, and Cursor comes very convenient to have all three in a single interface. Also I still code manually especially when prototyping, so having an IDE helps with it as well. I knew about OpenVSX situation with the search, so when installing extensions I always did triple-checking to verify the extension being really submitted by upstream and not by squatter; but now given upgrades can also deliver a compromise I am thinking of developing an extension that will act in similar manner to pnpm minimum release age.
Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.
The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s
Vibecoders are safu
Boris: "By winter 2025, 100 percent of my code was written by Claude Code. Not a single line by hand."
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you
Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
>Also, all their tags are immutable, and so can't just be deleted to hide things
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
You’re right, I read too quickly.
No worries, it's very unexpected. I just remembered because I did the same thing last week and was surprised it worked.
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
You make a good point, my comment above probably overstates things.
How legit is this? Seems low on details.
I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
1shooner posted this link: https://www.binance.com/en/square/post/10-30-2026-claude-cod... this was not the official extension. Supply Chain is very important, please only use official builds. From the link above:
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
Better be safe and check your dev environment if you use it.
Is there any proof of this or are we just upvoting garbage?
https://cursor.com/blog/claude-code-extension-security-notic...
This is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.
That's not the actual hack though, it's with an extension. You could have gotten compromised this way through an extension for git or whatever.
My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless
Kevin Beaumont says the extension for “VSCode and Cursor” was compromised: https://cyberplace.social/@GossiTheDog/117528831681803563
My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.
He says to follow his social, and he provides his handle, but there's no link, and I have no idea how to read it.
You can see his posts at https://cyberplace.social/@GossiTheDog/
Eh, he's already lost me the moment he made it difficult.
If you don’t have anything to steal, you don’t need to follow a security researcher anyway.
/s
If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.
Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
now I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.
For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.
That's why I stay away from that dumpster fire too!
Every dumpster fire has a silver lining when people who deserve it get burned.
♟
Keep sending all your secrets and giving full control of your devices to Anthropic.
This is fine.