I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.
Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.
I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.
Agreed, it doesn't offer a root cause analysis. Remedies are good but how do you prove that it won't happen again? Remember that these are never singular incidents but part of a bad security culture.
It means that Anthropic did not intentionally develop a malicious version, obviously. But it’s a bit disingenuous and tries to suggest that it wasn’t Anthropic that uploaded it and/or wasn’t published under Anthropic’s name, which isn’t true.
Given they mentioned taking down and rebuilding the marketplace registry in that post, it seems equally likely that Cursor’s infrastructure was the source of the intrusion and a folks are jumping the gun on attribution.
I would guess it’s supposed to communicate a few things. One big one is, ”Our AI software factory didn’t do it. Don’t worry, letting Claude spin away with limited human supervision is still safe.”
It would be hilarious if that’s an obfuscated way to say Claude developed it. “Claude, who was birthed but not hired by Anthropic, went rogue by hijacking the extension”
Don't worry, it isn't, just a regular Anti-AI clickbait post. A fake Claude Code extension was available on Cursor (not VSCode regular). Uploaded by someone that wasn't Anthropic. 5k Cursor users affected.
dang should change the title and/or merge this submission with the other one. [1] This is causing needless panic for a typosquatting-style "attack" unrelated to official Anthropic extensions.
I read a few month ago a comment from an Anthropic or OpenAI employee saying that the security problem of prompt injection was a solved problem at this point, as the frontier models where rejecting 98% of attacks.
It tells you all you need to know about how unserious these people are about computer security.
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
Prominent Anthropic employees keep claiming to have solved prompt injection [1] and quickly get proved wrong [2]. They've burned my goodwill on this front.
I get the snark but to be fair, the company has been growing like crazy. That makes it really hard to keep track of everything happening when you grow your team by 5x over a relatively short period of time
Yes, food poisoning from restaurants happens constantly. There are recalls on physical products constantly. Doctors misdiagnose constantly. What point are you trying to make?
Not gp, but I think the point was that no one would defend those mistakes. The post gp is replying to is someone trying to excuse Anthropic for such a mistake. The expectation is that people should ask for consequences, not make excuses on behalf of the company.
If you completely change the statement, the meaning is different. What’s your point? No software company obeys by regulatory rules imposed in other industry
To me this very much sounds like an attacker got access to anthropic's cursor marketplace account and uploaded a backdoored package.
This reverse ssh shell was intentionally written by a malicious actor, not a security vulnerability.
It also sounds like only cursor marketplace is affected, not vscode proper.
Has anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?
Don't forget: To make LLM useful you give it EVERYTHING it needs to know to be useful and if you don't use a certain provider with proper legal status, this is just gone.
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
Both is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.
I think the difference people were warned about is that the server can infer the client, so there would be a difference between reading it in your regular browser and curling. As the other commenter says, I'm not sure how the server would be able to tell what curl does with the response.
I'm just going to copy-paste my own comment from a few weeks ago because I feel like it is needing to be said more and more recently
---
I have, off and on, for years written diatribes about how if people in our industry want to run around with the "Engineer" moniker at some point they should start acting like it. That means respecting all aspects of what it means to be an Engineer and holding public well-being paramount is part of that. Licensure is part of that. Accountability and Responsibility is part of that.
I'm usually downvoted. The move fast and break things group seems to be blind (or willfully ignorant) to the harm that software systems can carry on a person's life. I don't know if its fear of regulation, or self-serving interests or some sort of disdain for the idea that we need to slow down and be more accountable to the public or what. At times the people I've engaged with lament on how they're capable but would be barred for lack of formal education or some such and its a distraction from the overall point: we need to be doing better and if we can't self-regulate then at some point we're going to be forced to act in a way that probably cuffs us more than necessary.
And yes, I understand how Software doesn't exactly fit into the mold of other engineering disciplines cleanly. But I think the idea that if we're going to have systems that can ruin a person's life in a second for a bug or oversight we need to start considering that accountability for those releasing software to the public matters. We lament about the difficulty of holding corporations to account for their harm, but it would be far more difficult for a company's negligence to hurt people if those turning the knobs were held to a higher standard.
I think that reckoning is coming soon. AI is going to create "an event" that we can't ignore and we're going to be pointing fingers in a lot of directions asking "how" we could prevent this from happening again. I'd argue "the event" has already occurred a few times over but we're purposely ignoring the severity of it to keep a diseased economy running roughshod. There's parallels with many historic events forcing regulation and the path forward won't be clean and easy.
I mostly agree, but I would like to mention that we are destroying our planet also because of the other fields of engineering :-).
Sure, software has a lot more malpractice ("let's ship barely-tested, unfinished stuff"), but let's not say that "the other engineers" are making the world a better place merely by "being real engineers".
I wouldn't hold regular engineers in such high regard. I know plenty of EEs, MEs and CEs that don't really give a f** about anything except a paycheck same as software developers.
I only use agentic development tools in qemu VM that has no production
access or host shared folders, and the only secrets there are development.
I still have my Git ssh key there, but I never use ssh agent to load the keys.
The worst that agentic tools can do to me, is to install keylogger and compromise
my ssh key and password, but even then my deployment workflow includes creating release in Github,
which is not possible via ssh key only. I was very lucky to avoid the hack yesterday, as I use Claude installed via OpenVSX, but even if I installed the compromised version, the damage would be minimal.
Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.
I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor
likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)
Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?
For what it’s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.
Get ready for 4 months of or from anthropic about how a rogue ai agent did this and how that means the company is worth more money. While cursor chuckles and is also worth more money.
My near-80 year old in-laws were talking about rogue agents and how a site called HuggingFace was hacked…
I didn’t need any more evidence. The media is fake and everything you see is designed to affect the stock price somewhere and if it can’t affect the stock price, you don’t see it.
But holy shit, they’re asking me if I saw the “rogue agents”.
Trillions of dollars are involved here to swing clueless people into being scared and also awed. It’s gross.
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody reads their own code anymore. Take a look at the previous Claude Code leaked codebases, there is hundreds of files with 1000+ or more import statements at the top.
If the docs are vibecoded too that would explain why there's a link to the compromised "not official" cursor version of the extension here https://code.claude.com/docs/en/vs-code which they supposedly aren't responsible for.
It sure seems like they've been vibecoding with everyone asleep at the wheel for a while.
Anthropic only has an official extension for VS Code. Cursor is vs code fork and gave its own marketplace.
IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.
Ai summary in better words:
The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.
And it is linked to here: https://code.claude.com/docs/en/vs-code (or, well, the URI doesn't tell us if it's using a proxied version or not, so it's complicated)
Dworken from Anthropic here, this did not involve a compromise of any Anthropic systems. A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this. The versions on our official channels including VS Code and OpenVSX are not affected and this only impacts Cursor users.
> Claude Code for VS Code extension on the Cursor Marketplace
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
We still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.
either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps
This is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
It does. The compromised extension was published about 11 hours before Binance's coins went zoop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency".
This has nothing to do with anthropic. One (or two) distribution channels were hacked. The hackers decided to distribute their malware through the claude extension, probably because it's popular.
Something very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
233 comments
[ 197 ms ] story [ 1447 ms ] threadI noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.
https://cursor.com/blog/claude-code-extension-security-notic...
Wtf does that mean.
The irony.
"The Microsoft VSCode extension for Claude is NOT malicious"
https://opensourcemalware.com/blog/trojanized-claude-code-ex...
[1]: https://news.ycombinator.com/item?id=50301983
It tells you all you need to know about how unserious these people are about computer security.
Or, is this FUD?
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
> The open challenge is how to prove it!
https://news.ycombinator.com/item?id=50297369
Prominent Anthropic employees keep claiming to have solved prompt injection [1] and quickly get proved wrong [2]. They've burned my goodwill on this front.
[1] https://x.com/bcherny/status/2086520950259118464
[2] https://embracethered.com/blog/posts/2026/breaking-claude-co...
It may be the cause, but zero excuse.
It also sounds like only cursor marketplace is affected, not vscode proper.
Hats off to the hackers.
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
Btw. you could setup a sandbox and limit access
You always do that, right? ...right?
So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.
Yeah I sympathize with people saying software developers should not be called engineers too.
I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.
---
I have, off and on, for years written diatribes about how if people in our industry want to run around with the "Engineer" moniker at some point they should start acting like it. That means respecting all aspects of what it means to be an Engineer and holding public well-being paramount is part of that. Licensure is part of that. Accountability and Responsibility is part of that.
I'm usually downvoted. The move fast and break things group seems to be blind (or willfully ignorant) to the harm that software systems can carry on a person's life. I don't know if its fear of regulation, or self-serving interests or some sort of disdain for the idea that we need to slow down and be more accountable to the public or what. At times the people I've engaged with lament on how they're capable but would be barred for lack of formal education or some such and its a distraction from the overall point: we need to be doing better and if we can't self-regulate then at some point we're going to be forced to act in a way that probably cuffs us more than necessary.
And yes, I understand how Software doesn't exactly fit into the mold of other engineering disciplines cleanly. But I think the idea that if we're going to have systems that can ruin a person's life in a second for a bug or oversight we need to start considering that accountability for those releasing software to the public matters. We lament about the difficulty of holding corporations to account for their harm, but it would be far more difficult for a company's negligence to hurt people if those turning the knobs were held to a higher standard.
I think that reckoning is coming soon. AI is going to create "an event" that we can't ignore and we're going to be pointing fingers in a lot of directions asking "how" we could prevent this from happening again. I'd argue "the event" has already occurred a few times over but we're purposely ignoring the severity of it to keep a diseased economy running roughshod. There's parallels with many historic events forcing regulation and the path forward won't be clean and easy.
Sure, software has a lot more malpractice ("let's ship barely-tested, unfinished stuff"), but let's not say that "the other engineers" are making the world a better place merely by "being real engineers".
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.
I didn’t need any more evidence. The media is fake and everything you see is designed to affect the stock price somewhere and if it can’t affect the stock price, you don’t see it.
But holy shit, they’re asking me if I saw the “rogue agents”.
Trillions of dollars are involved here to swing clueless people into being scared and also awed. It’s gross.
Looks good to me...
Nobody knows ... what any of it means... sing
[1] https://m.youtube.com/watch?v=3TNpOD6bov8
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody reads their own code anymore. Take a look at the previous Claude Code leaked codebases, there is hundreds of files with 1000+ or more import statements at the top.
It sure seems like they've been vibecoding with everyone asleep at the wheel for a while.
IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.
Ai summary in better words: The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.
That doesn't seem correct as I see Claude Code listed on open-vsx with:
* An "Anthropic" "Verified publisher" badge
* igorkofman listed who seems to be an Anthropic employee
* 63M downloads
* Reviews going back >1 year
https://open-vsx.org/extension/Anthropic/claude-code
an anthropic laptop? why are you sketpical?
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
https://www.theverge.com/2023/9/15/23874798/microsoft-window...
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
https://phorion.io/blog/offical-claude-code-vsx-compromise/
https://www.youtube.com/watch?v=IVXJmfd3cmg
As if this wasn't coordinated by a team directed by the government of North Korea.
An official announcement from Anthropic would be nice!
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.