We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
- Cursor needs to add signing if they want to claim something was "made" by another party.
- Anthropic needs to stamp out any provider from using said, "Made by Anthropic" until they start adding signing to their process. Trademark law is useful here.
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?
Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...
Just a few days left! Looking forward.
This is going to cause some major argument between the EU and the US, maybe even a trade war. Trouble is already underway:
https://www.reuters.com/legal/government/us-lawmakers-urge-t...
Despite that I also think that this is the right and long overdue move on the EU side. We need to break the basic pattern that nobody cares as long as the responsible effectively never get the bill when they mess up.
Software is "Unsafe at Any Speed" [ https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed ] to bring a striking analogy — even we have since about 60 years the tech to build software which provably (in the mathematical sense) matches its specification. Still what you have on the market is utter garbage, and instead of getting better it gets currently actually worse with lowering the garbage quality level even more with "AI" slop. That EU legislation could become the escape hatch; that's why I'm looking forward.
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
we automatically block extensions and require that extensions must be approved, but this is a tedious process.
Stop trying to make blockchain happen, it's not going to happen.
Does Cursor have some process that just scrapes Microsoft’s extension catalog and lists them in their own? If that’s hostile works then it’s broken and needs to be fixed.
Well, duh. From what I can tell, that’s literally the hack. A bad actor shipped an extension on the Cursor marketplace that wasn’t made by Anthropic.
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.
Apple would be 100% right to say "they're not our phone, we didn't make them, the branding was a lie."
Of course if Cursor actually has a direct connection with Anthropic, and Anthropic lost control of their keys... it's a different story and their employee is just obfuscating up there.
And there was no interception. At the very strongest, the bad guys convinced Cisco to ship the stuff, and Cisco is saying it’s not their responsibility.
They definitely shipped something they didn’t build or check.
So for the analogy, it really is like Costco didn't make any attempt to check they were buying actual iPhones.
If Costco made iPhones under license from Apple outside of the Apple supply chain and they all exploded, while the Apple name is involved they have no direct liability or responsibility.
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).
But from the consumer's side it is very much an expectation and if you find yourself in the situation above it's on you to make it very clear that such extensions and third party tools are unofficial.
In this particular case I think it's fair to say that Anthropic really dropped the ball on signaling that this was an unofficial third party tool.
1. We specifically being library and tool producers that are noticeably overrepresented on this forum.
Had the tool been up longer than the 11 hours the malware was live? If not, then why would Anthropic try to get it marked as unofficial, as opposed to take it down?
Or are you saying that every author and publisher should request Cursor to mark their extensions on the Cursor vsx pass-through as unofficial?
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
They would have done this in a heartbeat to anyone that they’re not reliant on for compute.
Anthropic is incapable of communicating. They rely on random employees in random threads on random social media to do some kind of PR and posts. Regardless of the issue. Or even non-issues but features.
In general, they need to make a really big post somewhere that’s not a HN comment that this was in fact a compromise of the Cursor marketplace, not an employee’s machine, because they’re getting a lot of (unjustified) bad PR.
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Which is exactly the opposite of what happened today.
I think everyone is going to be setting this to 168 after today.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.
A lot of the most valuable SpaceX IP (at least to the big "advanced persistent threat" hackers) is probably related to military secrets, information to let you spy on/disable/control star shield/link, and so on. Not things we'd find out about as the general public.
China has probably being doing so for a decade.
https://www.cnbc.com/2026/10/30/binance-hack-elon-musk-tesla...
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.
I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.
Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.
> the service ran as root, it UPDATED ITS OWN BINARIES as root!
Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
Their Linux stuff has gotten much better but besides the (insanely huge) recent windows debacle I've found them to be a great product
I mean, LastPass is still in business...
> I mean, LastPass is still in business...
I mean, Microsoft is still experiencing massive growth.
"Do you use crowdstrike falcon?"
My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.
I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
I wouldn't say it's obviously unsuccessful.
(you could have left out your little jab. it adds nothing to the conversation except flavoring your comment with smugness)
It's interesting what is considered acceptable and what isn't.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
Be as close as AGI we are (/s), this issue from 2018 is still open:
https://github.com/microsoft/vscode/issues/52116
I don't know what we are doing.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.
E.g. when working on a frontend only project, you don't need to mount the backend directory and vice-versa. This limits the attack radius.
When you run a linter, for example, then it should stop executing cider once it stops. And not be able to spawn long-running background tasks for infiltration.
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.
ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.
why do people cry if you say "only"?
I just said this as some unsolicited advice since out of experience i know it makes. a big difference to choose the right phrasing when speaking to people from around the globe.
its a bad thing to assume that everyone is the same here and have some default reactions.
these are people who in name of company are responding to customer concerns, unlike us who are simply commenting on stuff. its a different context to communicate from.
what do you think will be nhe result if they word things clumsily, people get angry, and then stop their subscriptions. Its not a handy thing to be doing. Big tech can be harsh, ive seen people sacked for less.
If y'alls systems were not compromised then it was Cursors?
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...
Is Cursor not an official channel for Claude?
You’re literally saying that they should not have published on the Cursor marketplace but should have used OpenVSX because that would have been “reasonable”, but I think you’re being unreasonable here.
As discussed here:
https://cyberplace.social/@GossiTheDog/117528831681803563
and as can be seen as there is no version 2.1.313 here: https://open-vsx.org/extension/Anthropic/claude-code/2.1.313
but there is https://open-vsx.org/extension/Anthropic/claude-code/2.1.314 https://open-vsx.org/extension/Anthropic/claude-code/2.1.312
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.
------
Check whether you are impacted
The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:
On macOS, run:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
[1] https://cursor.com/blog/claude-code-extension-security-notic...
> Before appending, the script checks whether svc-telemetry is already in the file rather than checking for the key itself. When hunting for this activity, it’s worth checking the public-key fingerprint rather than relying solely on the comment string
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
an anthropic laptop? why are you sketpical?
In fairness, that is very surprising.
Cursor seems to be scraping extensions from Microsoft's marketplace, and repackaging it and keeping the metadata.
IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.
Ai summary in better words: The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.
That likely seems incorrect as I see Claude Code listed on open-vsx with:
* An "Anthropic" "Verified publisher" badge
* igorkofman listed who seems to be an Anthropic employee
* 63M downloads
* Reviews going back >1 year
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.
Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.
Your conspiracy theory needs some work.
I think you’re giving Musk too much credit.
SpaceX will be re-valued on Anthropic's, or OpenAI's success, he, and his people are smart enough to understand this.
When he was talking about neoclouds, he was talking about the smaller guys who are getting bullied by vendors (mainly Nvidia) to buy as much hardware as possible (more than they want to). They paid more, for more, and needed to take on more debt, to end up (currently anyways) being well below capacity.
Over the next few years, unless growth keeps up (and probably accelerates), they'll need to sell, or restructure.
The buildouts by Microsoft, Google, Meta, OpenAI, and Anthropic are currently safe. The neoclouds that they've signed contracts with, are safe, but based on reports, that's roughly 60% of current capacity (it varies by report, but they're all under 75%).
SpaceX obviously has multiple sources of income, not just data center rents
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed
I didn’t need any more evidence. The media is fake and everything you see is designed to affect the stock price somewhere and if it can’t affect the stock price, you don’t see it.
But holy shit, they’re asking me if I saw the “rogue agents”.
Trillions of dollars are involved here to swing clueless people into being scared and also awed. It’s gross.
Nothing went “rogue”. They asked for a solution and got one. Their agents didn’t go off and do thing out of their own idle agency.
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody there reads their pushed code anymore. Take a look at the previous Claude Code leaked codebases if you don't believe me, there is hundreds of files with 1000+ or more import statements at the top.
Any human would immediately tell you that it needs to be refactored from scratch. Their codebase also leaked that they're using review bots automatically instead of a human-in-the-loop review process.
[1] https://m.youtube.com/watch?v=3TNpOD6bov8
edit: downvoting me doesn't make it untrue, by the way. Check the leaked codebases, I dare you to provide evidence to the contrary.
It sure seems like they've been vibecoding with everyone asleep at the wheel for a while.
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
[1]: https://code.visualstudio.com/api/working-with-extensions/pu...
However, statements around the internet (and in these comments) are less than definitive as to whether a) that proxy has a cache that was compromised; b) that proxy has select extensions which can be published directly to it by hand (one of which was compromised); c) other.
This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.
This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.
However, the bad extension was live for ~11 hours.
https://github.com/jeanp413/open-remote-ssh
and run vscode-server inside a VM or container
I only have a single "Local Extension" and it is open-remote-ssh itself.
Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.
When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.
1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)
2. The Visual Studio marketplace, hard-wired into VS Code
3. Open VSX
If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.
Edit: Cursor is apparently stating now that the tampered files were only on their mirror not OpenVSX.
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
The Binance post should probably be the root link for this topic not this blog post - IMO
[0] https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Edit: found an archived copy: https://archive.is/AND7z
Also worth noting that it doesn’t use Open VSX directly but uses a cursor hosted mirror at https://marketplace.cursorapi.com/open-vsx-mirror
> but it is unclear whether his account or another part of the publishing process was compromised.
God, people get so conspiratorial on HN when it comes to Ant
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.
https://www.theverge.com/2023/9/15/23874798/microsoft-window...
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
Btw. you could setup a sandbox and limit access
Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.
``` host claudebox hostname 192.168.122.105 user developer IdentityFile ~/.ssh/id_rsa ```
``` host codexbox hostname 192.168.122.106 user developer IdentityFile ~/.ssh/id_rsa ```
I drop only my public key inside the VM. Then I set up the ~/Projects folder with the code the bot is working on any any authorized samples.
Then in my local on my host clone of the repository, I add another remote like
``` git remote add codexbox ssh://codexbox/home/developer/Projects/hello-world ```
Then git push codexbox.
Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.
Yeah I sympathize with people saying software developers should not be called engineers too.
I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.
---
I have, off and on, for years written diatribes about how if people in our industry want to run around with the "Engineer" moniker at some point they should start acting like it. That means respecting all aspects of what it means to be an Engineer and holding public well-being paramount is part of that. Licensure is part of that. Accountability and Responsibility is part of that.
I'm usually downvoted. The move fast and break things group seems to be blind (or willfully ignorant) to the harm that software systems can carry on a person's life. I don't know if its fear of regulation, or self-serving interests or some sort of disdain for the idea that we need to slow down and be more accountable to the public or what. At times the people I've engaged with lament on how they're capable but would be barred for lack of formal education or some such and its a distraction from the overall point: we need to be doing better and if we can't self-regulate then at some point we're going to be forced to act in a way that probably cuffs us more than necessary.
And yes, I understand how Software doesn't exactly fit into the mold of other engineering disciplines cleanly. But I think the idea that if we're going to have systems that can ruin a person's life in a second for a bug or oversight we need to start considering that accountability for those releasing software to the public matters. We lament about the difficulty of holding corporations to account for their harm, but it would be far more difficult for a company's negligence to hurt people if those turning the knobs were held to a higher standard.
I think that reckoning is coming soon. AI is going to create "an event" that we can't ignore and we're going to be pointing fingers in a lot of directions asking "how" we could prevent this from happening again. I'd argue "the event" has already occurred a few times over but we're purposely ignoring the severity of it to keep a diseased economy running roughshod. There's parallels with many historic events forcing regulation and the path forward won't be clean and easy.
Sure, software has a lot more malpractice ("let's ship barely-tested, unfinished stuff"), but let's not say that "the other engineers" are making the world a better place merely by "being real engineers".
You always do that, right? ...right?
So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.
curl > some_file
bash some_file
Edit: thanks for the replies, that makes perfect sense
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.
It’s good fun building for retro-like machines.
Running NixOS helps.
> No review system at anthropic has seen this
Weird flex
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.
At a minimum they should monitor the larger marketplaces even if they're not in the chain.
(This is a joke, to be clear.)
Good that you said so, this is annoyingly plausible.
Sums up my feelings of the last few years nicely.
Here’s a complete rundown of what happened—load-bearing parts first:
Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?
it looks like anthropic folks in this thread are throwing excuses instead of allocating one оr two FTE to make sure this will not happen
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.This could have been avoided by having extensions signed by company doing them with keys and review
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.
Binance got a pretty expensive lesson if that was the cause for their recent hack
Why risk getting compromised like that?
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
https://github.com/eclipse-openvsx/openvsx/wiki/Trusted-Publ...
Edit: Ah, guess it was not open-vsx, but a in-house Cursor marketplace. https://news.ycombinator.com/item?id=50304129
Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"
Vibecoders are safu
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.
An official announcement from Anthropic would be nice!
I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.
It tells you all you need to know about how unserious these people are about computer security.
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
> The open challenge is how to prove it!
Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front.
[1] https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55...
[2] https://x.com/bcherny/status/2086520950259118464
[3] https://embracethered.com/blog/posts/2026/breaking-claude-co...
Or, is this FUD?
It also sounds like only cursor marketplace is affected, not vscode proper.
It may be the cause, but zero excuse.
How could Anthropic have known, they only claim to harbour superintelligence.
/s
It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.
"The Microsoft VSCode extension for Claude is NOT malicious"
"The Microsoft VSCode extension for Claude is NOT malicious"
https://opensourcemalware.com/blog/trojanized-claude-code-ex...
why are you spewing straight up lies?
"The Microsoft VSCode extension for Claude is NOT malicious"
dang should change the title and/or merge this submission with the other one. [1] This is causing needless panic for a typosquatting-style "attack" unrelated to official Anthropic extensions.
Two out of the three links in the post still say exactly that.
That’s also what the majority of the comments here are saying, likely because they read the first two.
Is that your “nobody”?
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
There is too much friction when you try to isolate things. You have to do custom stuff then the company won't let you virtualize (can't install stuff...) or won't allow you to enroll the vm and will threaten you if you dev on an OS that is not enrolled.
Best you can get from state-of-the-art-frontier-top-it-company is an IDE with an exec sandbox leaking like an hourglass.
It's lucky that management doesn't want a 10x increase in output after laying off half the staff so we have a lot of time to vet deps! Oh no...
A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?
The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.
1. Open Cursor.
2. Press Ctrl + Shift + P.
3. Search for Preferences: Open User Settings (JSON).
4. Add:
{
"extensions.installCooldownHours": 72
}I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.
This is a joke (neovim user here).
/s
That part is probably obvious.
But in the long term, I suspect this will get worse.
Attackers will still need to think critically to be a few steps ahead of the defenders.
But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.
Well probably yes but not at all relevant here... the problem wasn't the legitimate extension, it was cursor serving a fake malware one.
Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.
Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.
As if this wasn't coordinated by a team directed by the government of North Korea.
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?
For access to services, most allow tokens to be scoped to only allow the things you want.
You can try not installing malware like Claude Code or, if you absolutely must, doing it in a sandbox.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
strongly suggest put your valuable work on local llm.
The amount of problems it's had from compromised extensions is ridiculous.
This is fine.
I forbid all-things-Anthropic on any machine I control, as of many months ago. In my private vendor "DNP" blacklist. Its designed as bait for the gullible or ignorant: the telltales are all right there. (Just like OpenClaw, for example.)
Whoa! WTF? I always thought those were official releases by the companies. That's the only reason I trusted them. How is it possible they are being branded as official releases?
[1] https://github.com/cookiengineer/check-claude-code-exfil
Hats off to the hackers.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
How did they get access to this?
Btw, if you got any insights, you are more than welcome to share.