We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
> but it wasn’t a compromise of Anthropic’s systems or employee laptops.
Seems a bit early to say.
> A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.
For a pretty limited definition of "we" true and obvious. For the interesting definition of "we", proven through the access, not true.
> The versions on our official channels are not affected and this only impacts Cursor users.
A responsible vendor would have considered the Cursor (OpenVSX) extension an official channel. The extension hosted there even has Anthropic copyright notices and Anthropic terms of use. Pretty ridiculous an extension on a channel with 63 million downloads is not official.
I dont know a single person who uses this tool (but im sure there are some) our annual subs recently ran out, I hadnt used mine in 6 months, we did not renew.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?
Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.
I read a few month ago a comment from an Anthropic or OpenAI employee saying that the security problem of prompt injection was a solved problem at this point, as the frontier models where rejecting 98% of attacks.
It tells you all you need to know about how unserious these people are about computer security.
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
A 30 second search turned up this [1] from two days ago.
Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front.
I'm not asking this in rhetoric; do you happen to have a link to this comment? I ask because a comment like that would be something of an insane thing for someone to say.
To me this very much sounds like an attacker got access to anthropic's cursor marketplace account and uploaded a backdoored package.
This reverse ssh shell was intentionally written by a malicious actor, not a security vulnerability.
It also sounds like only cursor marketplace is affected, not vscode proper.
I get the snark but to be fair, the company has been growing like crazy. That makes it really hard to keep track of everything happening when you grow your team by 5x over a relatively short period of time
Yes, food poisoning from restaurants happens constantly. There are recalls on physical products constantly. Doctors misdiagnose constantly. What point are you trying to make?
Not gp, but I think the point was that no one would defend those mistakes. The post gp is replying to is someone trying to excuse Anthropic for such a mistake. The expectation is that people should ask for consequences, not make excuses on behalf of the company.
It always about “we solved the bottleneck in coding”. But the slowness was not about typing, or finding docs. It’s always about ensuring screwups don’t happen.
To be fair it’s not like screwups were not happening before, but if you move 100x faster and are 50x more secure than before you’re still 2x more exposed.
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor
likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)
I don't think Spacex cares at all about Anthropics IPO just because they rent out their compute.
Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.
The person at the top refers to Anthropic as "Misanthropic". It seems unlikely that they're also intentionally lying about this to protect Anthropic's interests.
Wasn’t Elon Musk shouting a few days ago that neoclouds are going to crash, the money dried up and that SpaceX was the last company with the opportunity to raise more money?
True, but there are other people working at the companies that probably own stock in both their own company and some of the others...if you believe that this is the future, you'd be a fool to buy non-AI tech stocks, right?
Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?
For what it’s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.
Anthropic only has an official extension for VS Code. Cursor is vs code fork and gave its own marketplace.
IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.
Ai summary in better words:
The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.
Get ready for 4 months of pr from anthropic about how a rogue ai agent did this and how that means the company is worth more money. While cursor chuckles and is also worth more money.
My near-80 year old in-laws were talking about rogue agents and how a site called HuggingFace was hacked…
I didn’t need any more evidence. The media is fake and everything you see is designed to affect the stock price somewhere and if it can’t affect the stock price, you don’t see it.
But holy shit, they’re asking me if I saw the “rogue agents”.
Trillions of dollars are involved here to swing clueless people into being scared and also awed. It’s gross.
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody there reads their pushed code anymore. Take a look at the previous Claude Code leaked codebases if you don't believe me, there is hundreds of files with 1000+ or more import statements at the top.
Any human would immediately tell you that it needs to be refactored from scratch. Their codebase also leaked that they're using review bots automatically instead of a human-in-the-loop review process.
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.
Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.
I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.
This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.
That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.
> You could download the extension, diff it against the previous version and read all the code.
This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.
The CTA flavor of the year for dev tools is cURLing some arbitrary install script and run it immediately which always sounded ridiculous to me. If instead that script first pipes into claude -p for a basic vulnerability scan before continuing, I would be delighted.
Most extensions run in vscodium-server, extensions run either as "Local Extensions" that run on the host and "Remote Extensions" that run on the guest. You can clearly see in the UI which ones run where.
I only have a single "Local Extension" and it is open-remote-ssh itself.
Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.
When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.
Three different marketplaces have been mentioned in this discussion:
1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)
2. The Visual Studio marketplace, hard-wired into VS Code
3. Open VSX
If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.
I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.
Agreed, it doesn't offer a root cause analysis. Remedies are good but how do you prove that it won't happen again? Remember that these are never singular incidents but part of a bad security culture.
Given they mentioned taking down and rebuilding the marketplace registry in that post, it seems equally likely that Cursor’s infrastructure was the source of the intrusion and a folks are jumping the gun on attribution.
I would guess it’s supposed to communicate a few things. One big one is, ”Our AI software factory didn’t do it. Don’t worry, letting Claude spin away with limited human supervision is still safe.”
It means that Anthropic did not intentionally develop a malicious version, obviously. But it’s a bit disingenuous and tries to suggest that it wasn’t Anthropic that uploaded it and/or wasn’t published under Anthropic’s name, which isn’t true.
It would be hilarious if that’s an obfuscated way to say Claude developed it. “Claude, who was birthed but not hired by Anthropic, went rogue by hijacking the extension”
I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?
Don't forget: To make LLM useful you give it EVERYTHING it needs to know to be useful and if you don't use a certain provider with proper legal status, this is just gone.
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
I only use agentic development tools in qemu VM that has no production
access or host shared folders, and the only secrets there are development.
I still have my Git ssh key there, but I never use ssh agent to load the keys.
The worst that agentic tools can do to me, is to install keylogger and compromise
my ssh key and password, but even then my deployment workflow includes creating release in Github,
which is not possible via ssh key only. I was very lucky to avoid the hack yesterday, as I use Claude installed via OpenVSX, but even if I installed the compromised version, the damage would be minimal.
I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.
Wow, great notion about using git remote to transfer source from the agent host. I already use ssh into VM to transfer the files like designs for sharing, so going to adopt your approach right now :)
Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.
Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.
This was a compromise of the extension. The same kind of supply-chain attack could happen to literally any extension, package or other piece of software you install. Not excusing Anthropic letting this happen, but it doesn't have any bearing on the security and privacy of using Claude Code or Codex. Yes, you need to be careful about what they do. The fact that you might still get pwned via some other vector is irrelevant.
Can't their millions of agent swarms detect a malicious supply chain vector, sure it can happen to any company but not the one people are literally handing over their entire companies too.
Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.
Both is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.
I think the difference people were warned about is that the server can infer the client, so there would be a difference between reading it in your regular browser and curling. As the other commenter says, I'm not sure how the server would be able to tell what curl does with the response.
Anthropic is a weird company. On the one hand they have this messianic thing about their super intelligence, on the other hand it is incapable of keeping their own house secure. But you should trust it.
I think right now AI is helping the attackers more than it's helping the defenders.
That part is probably obvious.
But in the long term, I suspect this will get worse.
Attackers will still need to think critically to be a few steps ahead of the defenders.
But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.
Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
P(doom) crowd say Anthropic has not zero chance to destroy humanity.
What it is, the VS Code Extension Marketplace, including Cursor's, must be bigger.
> Claude Code for VS Code extension on the Cursor Marketplace
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
VS Code doesn't allow forks to use their marketplace, I think. At least with VSCodium, they don't. I think they even patch a workaround where you could download almost all extensions' .vsix files.
1. If only Cursor Marketplace version was compromised, how was it published in the first place?
2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?
The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.
Reading the report alone:
"First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."
A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.
either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps
We still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.
This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.
It does. The compromised extension was published about 11 hours before Binance's coins went zoop, Binance blamed a compromised developer laptop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency".
Something very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
Has anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.
I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.
This is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
What I dont understand is why the hell do these extensions & clis need to update every damn day. clearly there's no new models everyday, what the actual f.
Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
> but it wasn’t a compromise of Anthropic’s systems or employee laptops.
Seems a bit early to say.
> A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.
For a pretty limited definition of "we" true and obvious. For the interesting definition of "we", proven through the access, not true.
> The versions on our official channels are not affected and this only impacts Cursor users.
A responsible vendor would have considered the Cursor (OpenVSX) extension an official channel. The extension hosted there even has Anthropic copyright notices and Anthropic terms of use. Pretty ridiculous an extension on a channel with 63 million downloads is not official.
The extensions does not need full access to the laptop.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
Probably a good idea to only run LLMs with a dedicated user account, or in a container.
Dedicated user account does not work as eventually all your code and data will move under that.
I run it in an ephemeral container which has access to the current working directory and it drastically limits the attack radius.
If this isn't a damning indictment of Cursor, I don't know what is. Perhaps it will be the death knell.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
Seeing as SpaceX owns Curser, I’m surprised there wasn’t a hack on SpaceX… Yet
>Perhaps it will be the death knell
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
I believe the value add was $60bn in just 4 years https://www.linkedin.com/posts/sytaylor_wild-cursor-just-sol...
I dont know a single person who uses this tool (but im sure there are some) our annual subs recently ran out, I hadnt used mine in 6 months, we did not renew.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?
Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.
The situation is confusing, so can I please confirm the following:
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
Memphis will remember each and every one of you
> We’re working with Cursor on this incident
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.
That's literally impossible, with all the access to the frontier software development tools at their disposal they can ship features securely at 100x
I read a few month ago a comment from an Anthropic or OpenAI employee saying that the security problem of prompt injection was a solved problem at this point, as the frontier models where rejecting 98% of attacks.
It tells you all you need to know about how unserious these people are about computer security.
Simonw said the same thing yesterday:
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
> The open challenge is how to prove it!
https://news.ycombinator.com/item?id=50297369
A 30 second search turned up this [1] from two days ago.
Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front.
[1] https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55...
[2] https://x.com/bcherny/status/2086520950259118464
[3] https://embracethered.com/blog/posts/2026/breaking-claude-co...
I'm glad no one can steal from my bank, they stop 98% of thieves
Hey! It's at least 1 9's right? That's better than zero 9's LOL
Github's uptime getting stray bullets, I see.
I'm not asking this in rhetoric; do you happen to have a link to this comment? I ask because a comment like that would be something of an insane thing for someone to say.
Can you link to a list of this year’s top prompt injection hacks of frontier models?
Or, is this FUD?
https://genai.owasp.org/2026/07/08/genai-and-agentic-ai-expl...
To me this very much sounds like an attacker got access to anthropic's cursor marketplace account and uploaded a backdoored package. This reverse ssh shell was intentionally written by a malicious actor, not a security vulnerability.
It also sounds like only cursor marketplace is affected, not vscode proper.
I am afraid until 200x is achieved we are at risk...
Only with two fully maxed subscriptions can we achieve this, and this is forbiddeneded
Just put gastown on it!
I really don't think the scaling is so trivial.
On the other hand, they don't know what their models do or can do and nothing is safe ever, so ???
It's just a conscious being confined in a cluster of GPUs. How dangerous can it be, eh?
Shaka, when the context compacted
Anthropic: coding is solved Also anthropic: we ship actual malware to customers.
I get the snark but to be fair, the company has been growing like crazy. That makes it really hard to keep track of everything happening when you grow your team by 5x over a relatively short period of time
Now replace that statement with a food processing company, and food poisoning, or an aircraft designer and engineers.
It may be the cause, but zero excuse.
Yes, food poisoning from restaurants happens constantly. There are recalls on physical products constantly. Doctors misdiagnose constantly. What point are you trying to make?
Not gp, but I think the point was that no one would defend those mistakes. The post gp is replying to is someone trying to excuse Anthropic for such a mistake. The expectation is that people should ask for consequences, not make excuses on behalf of the company.
The correct comparison would be the food producer and poisoned foods out of the factory are really rare.
It's not like there haven't been 20 high visibility VS code extension malware attacks in the last year.
How could Anthropic have known, they only claim to harbour superintelligence.
/s
Yet, they managed to screw up.
:D I have to assume parent is being a little sarcastic.
It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.
It always about “we solved the bottleneck in coding”. But the slowness was not about typing, or finding docs. It’s always about ensuring screwups don’t happen.
To be fair it’s not like screwups were not happening before, but if you move 100x faster and are 50x more secure than before you’re still 2x more exposed.
Yes, bug count is roughly linear in the number of lines of code.
The original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys.
https://phorion.io/blog/offical-claude-code-vsx-compromise/
And try to launch sshd, right? Think of all the other things they could have done…
Not only launch sshd. They set up a reverse tunnel connection.
https://www.reuters.com/business/media-telecom/cursor-says-u...
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)
I don't think Spacex cares at all about Anthropics IPO just because they rent out their compute.
Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.
People at the top know that, once the music stops, the ball is over for everyone.
The person at the top refers to Anthropic as "Misanthropic". It seems unlikely that they're also intentionally lying about this to protect Anthropic's interests.
Your conspiracy theory needs some work.
Wasn’t Elon Musk shouting a few days ago that neoclouds are going to crash, the money dried up and that SpaceX was the last company with the opportunity to raise more money?
I think you’re giving Musk too much credit.
Neoclouds aren't Anthropic, OpenAI, and SpaceX. People aren't going to re-value value SpaceX on CoreWeave's success.
SpaceX will be re-valued on Anthropic's, or OpenAI's success, he, and his people are smart enough to understand this.
Didn't SpaceX partially admit they're a neocloud in their S-1?
True, but there are other people working at the companies that probably own stock in both their own company and some of the others...if you believe that this is the future, you'd be a fool to buy non-AI tech stocks, right?
Somebody doesn’t want anybody to have a bigger IPO than them.
OpenVSX has no extension signing, no verification, nothing...
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed
It's annoying how fast people run to conspiracy.
And pretend to know and understand the ties between big names
Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?
For what it’s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.
Anthropic only has an official extension for VS Code. Cursor is vs code fork and gave its own marketplace.
IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.
Ai summary in better words: The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.
Isn't it fun when all the lines are blurred and it is hard to tell what belongs where?
Get ready for 4 months of pr from anthropic about how a rogue ai agent did this and how that means the company is worth more money. While cursor chuckles and is also worth more money.
I think OpenAI will beat them to the claim
My near-80 year old in-laws were talking about rogue agents and how a site called HuggingFace was hacked…
I didn’t need any more evidence. The media is fake and everything you see is designed to affect the stock price somewhere and if it can’t affect the stock price, you don’t see it.
But holy shit, they’re asking me if I saw the “rogue agents”.
Trillions of dollars are involved here to swing clueless people into being scared and also awed. It’s gross.
…but “rogue” agents really did hack a site called HuggingFace?
LGTM
Looks good to me...
Nobody knows ... what any of it means... sing
[1] https://m.youtube.com/watch?v=3TNpOD6bov8
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody there reads their pushed code anymore. Take a look at the previous Claude Code leaked codebases if you don't believe me, there is hundreds of files with 1000+ or more import statements at the top.
Any human would immediately tell you that it needs to be refactored from scratch. Their codebase also leaked that they're using review bots automatically instead of a human-in-the-loop review process.
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.
Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.
I started experimenting with more traditional text editors since last spring and am happy to say, that I’m a happy user of Neovim now.
Does anyone know Microsoft's justification for that policy?
Windows has a builtin keyboard shortcut to open LinkedIn. This is just how they do things.
"Of course we don't make mistakes. There's no need to delay our updates."
Wtf. That’s its own scandal
I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
[1]: https://code.visualstudio.com/api/working-with-extensions/pu...
You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.
This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.
What would be the careful way of installing the official extension?
That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.
> You could download the extension, diff it against the previous version and read all the code.
This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.
The CTA flavor of the year for dev tools is cURLing some arbitrary install script and run it immediately which always sounded ridiculous to me. If instead that script first pipes into claude -p for a basic vulnerability scan before continuing, I would be delighted.
Hopefully a well-sandboxed claude -p.
LLM are not designed for that. Unless prompt injection is really solved I would avoid showing LLM untrusted code.
You disable extension auto updates and then manually install every so often (and only update/install when the version has been out for 3+ days).
I recommend moving to VSCodium and using this extension:
https://github.com/jeanp413/open-remote-ssh
and run vscode-server inside a VM or container
Would that really help, if you install the extension it's running in the VSCodium instance on your machine... or is it running in the vscode-server?
Most extensions run in vscodium-server, extensions run either as "Local Extensions" that run on the host and "Remote Extensions" that run on the guest. You can clearly see in the UI which ones run where.
I only have a single "Local Extension" and it is open-remote-ssh itself.
Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.
When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.
The screenshot is of the official marketplace
Do you have any sources? OP claims that it *also* affects Open VSX
Three different marketplaces have been mentioned in this discussion:
1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)
2. The Visual Studio marketplace, hard-wired into VS Code
3. Open VSX
If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.
Cursor maintains a mirror of OpenVSX... Kinda. Except they inject some of their own extensions in it. But it's mostly a mirror.
Edit: Cursor is apparently stating now that the tampered files were only on their mirror not OpenVSX.
But the report OP cites at https://phorion.io/blog/offical-claude-code-vsx-compromise/ doesn't make a claim about Visual Studio Marketplace, only "the official Claude Code for VS Code extension bundle on the Cursor Marketplace"
I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.
Cursor has released a security notice:
https://cursor.com/blog/claude-code-extension-security-notic...
Edit: related https://news.ycombinator.com/item?id=50301983
Looks like a solid response with instructions and scripts how to get rid of the infection, but it doesn’t explain how it got there.
Agreed, it doesn't offer a root cause analysis. Remedies are good but how do you prove that it won't happen again? Remember that these are never singular incidents but part of a bad security culture.
> Cursor: "This malicious version of the extension was not developed by Anthropic."
Wtf does that mean.
Given they mentioned taking down and rebuilding the marketplace registry in that post, it seems equally likely that Cursor’s infrastructure was the source of the intrusion and a folks are jumping the gun on attribution.
Edit: I was correct. https://news.ycombinator.com/item?id=50304129
It sounds to me like they're saying it wasn't an Anthropic employee which decided to drop an SSH backdoor.
Well that is even worse...
I would guess it’s supposed to communicate a few things. One big one is, ”Our AI software factory didn’t do it. Don’t worry, letting Claude spin away with limited human supervision is still safe.”
It means that Anthropic did not intentionally develop a malicious version, obviously. But it’s a bit disingenuous and tries to suggest that it wasn’t Anthropic that uploaded it and/or wasn’t published under Anthropic’s name, which isn’t true.
someone got access to the account that can publish extension on cursor marketplace?
we got hacked by someone other than ourselves this time
Just by people they paid to represent them.
It means we are from now on in an era of plausible deniability.
It would be hilarious if that’s an obfuscated way to say Claude developed it. “Claude, who was birthed but not hired by Anthropic, went rogue by hijacking the extension”
> Related posts: Cursor earns AIUC-1 certification for agent security and reliability
The irony.
I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?
Don't forget: To make LLM useful you give it EVERYTHING it needs to know to be useful and if you don't use a certain provider with proper legal status, this is just gone.
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
Btw. you could setup a sandbox and limit access
I only use agentic development tools in qemu VM that has no production access or host shared folders, and the only secrets there are development. I still have my Git ssh key there, but I never use ssh agent to load the keys. The worst that agentic tools can do to me, is to install keylogger and compromise my ssh key and password, but even then my deployment workflow includes creating release in Github, which is not possible via ssh key only. I was very lucky to avoid the hack yesterday, as I use Claude installed via OpenVSX, but even if I installed the compromised version, the damage would be minimal.
I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.
Wow, great notion about using git remote to transfer source from the agent host. I already use ssh into VM to transfer the files like designs for sharing, so going to adopt your approach right now :)
Yup, I give them a custom entry in ~/.ssh/config like:
``` host claudebox hostname 192.168.122.105 user developer IdentityFile ~/.ssh/id_rsa ```
``` host codexbox hostname 192.168.122.106 user developer IdentityFile ~/.ssh/id_rsa ```
I drop only my public key inside the VM. Then I set up the ~/Projects folder with the code the bot is working on any any authorized samples.
Then in my local on my host clone of the repository, I add another remote like
``` git remote add codexbox ssh://codexbox/home/developer/Projects/hello-world ```
Then git push codexbox.
Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.
Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.
This was a compromise of the extension. The same kind of supply-chain attack could happen to literally any extension, package or other piece of software you install. Not excusing Anthropic letting this happen, but it doesn't have any bearing on the security and privacy of using Claude Code or Codex. Yes, you need to be careful about what they do. The fact that you might still get pwned via some other vector is irrelevant.
Can't their millions of agent swarms detect a malicious supply chain vector, sure it can happen to any company but not the one people are literally handing over their entire companies too.
Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.
> Who's checking?
Yeah I sympathize with people saying software developers should not be called engineers too.
I think that software engineering is very much engineering.
I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.
Maybe it’s easier to outsource.
Both is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.
You always do that, right? ...right?
I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.
So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.
I think the difference people were warned about is that the server can infer the client, so there would be a difference between reading it in your regular browser and curling. As the other commenter says, I'm not sure how the server would be able to tell what curl does with the response.
Heuristically: https://web.archive.org/web/20250622061208/https://www.idont...
Timing. A megabyte of "sleep 10;" would be read from the server more slowly when piped to bash versus written to a file
No but we use MCP so we’re fine.
In at least one case they were! https://cybernews.com/ai-news/grok-build-git-repository-uplo...
There’s a reason codex and the like improved like they did. You can simply look. Or hear about it on podcasts.
Anthropic is a weird company. On the one hand they have this messianic thing about their super intelligence, on the other hand it is incapable of keeping their own house secure. But you should trust it.
I think right now AI is helping the attackers more than it's helping the defenders.
That part is probably obvious.
But in the long term, I suspect this will get worse.
Attackers will still need to think critically to be a few steps ahead of the defenders.
But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.
Oh god... this needs more attention
An official announcement from Anthropic would be nice!
I’d expect nothing less than a post mortem on how this happened to be honest.
Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
P(doom) crowd say Anthropic has not zero chance to destroy humanity. What it is, the VS Code Extension Marketplace, including Cursor's, must be bigger.
> Claude Code for VS Code extension on the Cursor Marketplace
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
VS Code doesn't allow forks to use their marketplace, I think. At least with VSCodium, they don't. I think they even patch a workaround where you could download almost all extensions' .vsix files.
1. If only Cursor Marketplace version was compromised, how was it published in the first place?
2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?
The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.
Reading the report alone: "First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."
A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.
either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps
God only knows how many skeletons like this are in Bun now
We still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.
This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.
Have we just witnessed the greatest lateral movement in cybersecurity history? https://x.com/dinodaizovi/status/2116125553665458463?a=D1DiF...
If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.
Is that the rumor? Does the timing line up?
It does. The compromised extension was published about 11 hours before Binance's coins went zoop, Binance blamed a compromised developer laptop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency".
Incredible. Looking a bit more and more like this was the actual case. Wild stuff
Something very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
The descriptions around this are very confusing. Is this specifically the Cursor version, or the regular VS Code version too?
Has anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
That's not official extension though? Misleading title
This puts an entirely new spin on Elon trolling Binance on Twitter.
It's karma I guess
Thankfully coding is solved everyone
Another reason for not using VS Code and derived and all their mess of extensions. I'm glad running Claude Code in Ghostty/Terminal is not affected.
From https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.
Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.
It looks like they push an update every office day. I'm guessing if I installed 6 months ago and didn't update, that I should be fine?
I think VS Code extensions autoupdate by default, unless you disable it.
Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.
I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.
Emphasis on guessing. If/when there is an actual postmortem, you’ll know when the back door was introduced.
You are either lucky or compromised.
Not updating air gapped systems is a security feature, not a bug.
I don't care anymore, how are you supposed to defend yourself against attacks like this? Come and hack me.
> how are you supposed to defend yourself against attacks like this?
You can try not installing malware like Claude Code or, if you absolutely must, doing it in a sandbox.
This is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
What I dont understand is why the hell do these extensions & clis need to update every damn day. clearly there's no new models everyday, what the actual f.
Because we need velocity. If we don't have velocity, we die.
”I've confirmed Binance use Claude Code with this extension.”
^^ Had to verify that this was a real quote from the chain and not a joke. It is accurate.
Imagine backdooring 50+ million installs.
Hats off to the hackers.
5,000*
I think that's just the number Cursor has telemetry on. I think there's multiple distribution locations.
5000 is the cursor number for people on the cursor version of the store, not the VSCode store.
"Software is solved. Bugs are not yet solved"
I guess, this is why I'm building tix.im ...