<- Back
Comments (370)
- felixriesebergFelix from Anthropic here.We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
- jonas21This is from the Cursor blog [1] linked in the description, but repeating it here in case it's useful to anyone:------Check whether you are impactedThe malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:On macOS, run: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted" On Windows, run in PowerShell: $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ } if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" } ------[1] https://cursor.com/blog/claude-code-extension-security-notic...
- AdrianCXhttps://www.reuters.com/business/media-telecom/cursor-says-u...> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on ThursdaySo is this or isn't this from Anthropic and how did this happen?
- yubblegumThe original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys.https://phorion.io/blog/offical-claude-code-vsx-compromise/
- xx_nsI think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.[1]: https://code.visualstudio.com/api/working-with-extensions/pu...
- helsinkiandrew> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoorThat's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplacehttps://cursor.com/blog/claude-code-extension-security-notic...
- orlpSo if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.You can't even configure which publishers you "trust"...
- 1shoonerCursor reporting this: https://cursor.com/blog/claude-code-extension-security-notic...What appears to be an official Binance account reporting it also:https://www.binance.com/en/square/post/10-30-2026-claude-cod...
- anon-3988I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?
- paxySo let me get this straight – Elon was trolling Binance on Twitter, when in fact it was his own company that got hacked and led to the theft?
- glimsheWhy didn't Claude detect the hack and prevent it from affecting customers using its superhuman AGI reasoning?
- henearkrIt wasn't Anthropic that was hacked but SpaceXAI (their Cursor Marketplace).
- paxyIs there any proof of this or are we just upvoting garbage?
- jitbitOh god... this needs more attentionAn official announcement from Anthropic would be nice!
- richrichardssonHow legit is this? Seems low on details.I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
- eviksThat's literally impossible, with all the access to the frontier software development tools at their disposal they can ship features securely at 100x
- nunezKind of surprised that Cursor doesn't do checksum verification for plugins. That would have stopped this completely. (Unless it does and this backdoor is more theoretical than anything else.)
- gokuljsWhy is this not trending on Twitter
- HexDecOctBin> Claude Code for VS Code extension on the Cursor MarketplaceSo Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
- _hmjDevelopment must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
- ale42Is this affecting only people using Cursor or all VS Code users? The article specifically mentions the Cursor marketplace. But the affected version is indeed missing on the official VS Code marketplace, was it compromised too?
- kipropingMore details from Kevin Beaumont. "Anthropic got compromised. Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops. " https://cyberplace.social/@GossiTheDog/117528831681803563
- stbenjamWe still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.
- efficaxeither the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps
- riettaReading the report alone: "First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.
- hughwIdea: why don't all the various app stores and plugin repos use LLMs to review all submissions for security? Certainly in the human powered age that was too big a task to take on, but now it seems doable.
- paaloeyeP(doom) crowd say Anthropic has not zero chance to destroy humanity. What it is, the VS Code Extension Marketplace, including Cursor's, must be bigger.
- ihumanThis is just the version of extension on the Cursor marketplace, not the one on the VS Code marketplace, right?
- hemlock4593It's funny that's the point where people draw the line. But that basically every API based agent is doing RCE where commands are fetched from servers is perfectly fine.
- VoidWhispererMy question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless
- anonundefined
- riettaDo publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?
- lxgrSomething very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
- GlyptodonNormal VS code doesn't even use Cursor Marketplace, right? The way this is reported lacks clarity. Do people using plain CS Code even use the Cursor Marketplace? Or am I missing something?
- maayankHave we just witnessed the greatest lateral movement in cybersecurity history? https://x.com/dinodaizovi/status/2116125553665458463?a=D1DiF...
- jacquesmAnthropic is a weird company. On the one hand they have this messianic thing about their super intelligence, on the other hand it is incapable of keeping their own house secure. But you should trust it.
- reilly3000My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.
- misnomeHas anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
- vanbashanIs it related to today binance event?
- anonymous908213If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.
- pier25God only knows how many skeletons like this are in Bun now
- anonundefined
- mrweaselHow will they communicate and fix that. The affected version has been yanked from the marketplace: https://marketplace.visualstudio.com/items?itemName=anthropi... but that doesn't clean up infected machines.
- numbsafariThis puts an entirely new spin on Elon trolling Binance on Twitter.
- airhangerf15VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
- soundworldsThe descriptions around this are very confusing. Is this specifically the Cursor version, or the regular VS Code version too?
- shahbabyI think right now AI is helping the attackers more than it's helping the defenders.That part is probably obvious.But in the long term, I suspect this will get worse.Attackers will still need to think critically to be a few steps ahead of the defenders.But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.
- mindracerSome more detailshttps://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
- kirth_gersenThis is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.
- Handy-ManThat's not official extension though? Misleading title
- nubinetworkIt looks like they push an update every office day. I'm guessing if I installed 6 months ago and didn't update, that I should be fine?
- anonundefined
- rolosaHe says to follow his social, and he provides his handle, but there's no link, and I have no idea how to read it.
- blondie9xFrom https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.
- mindracerThe extension has over 27 million installs, ouch
- ricky_riskynot just anthropic, my product that used antigravity is also leaked and copied by google, these close ai company will undoubtably steal your code, file and data.strongly suggest put your valuable work on local llm.
- DEADF007I don't care anymore, how are you supposed to defend yourself against attacks like this? Come and hack me.
- K0nservIf the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.
- rhedakHonestly with AI getting smarter it feels like these kind of attacks will only increase...
- rvzThis is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.Claude Code was already malware, but with this attack you cannot trust the vendor either.In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
- acedTrexThankfully coding is solved everyone
- anonundefined
- villgaxWhat I dont understand is why the hell do these extensions & clis need to update every damn day. clearly there's no new models everyday, what the actual f.
- paaloeyeAnother reason for not using VS Code and derived and all their mess of extensions. I'm glad running Claude Code in Ghostty/Terminal is not affected.
- jedisct1Keep sending all your secrets and giving full control of your devices to Anthropic.This is fine.
- hem777”I've confirmed Binance use Claude Code with this extension.”
- cookiengineerIt's dangerous to go alone, take this [1][1] https://github.com/cookiengineer/check-claude-code-exfil
- anonundefined
- xteam♟
- try-working"Software is solved. Bugs are not yet solved"
- stopsayingsorryImagine backdooring 50+ million installs.Hats off to the hackers.
- felixriesebergFelix from Anthropic here.We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
- ankur_misra[flagged]
- hmokiguess[flagged]
- arbor-group[flagged]
- FortHire[flagged]
- primce1[flagged]
- umowbray[flagged]
- sirnicolaz[flagged]
- aidotguru[flagged]
- READ_A_BOOK[dead]
- coconut-13[dead]
- sarmedshafi[flagged]
- sick_of_slop[dead]
- nickphx[flagged]
- xteam[flagged]
- anonundefined
- poelziI guess, this is why I'm building tix.im ...