Anthropic hacked to deliver remote access trojan

Re:Anthropic hacked to deliver remote access trojan by helsinkiandrew on Friday October 30, 2026 @07:57AM (#50302743)

> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor

That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:

> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace

https://cursor.com/blog/claude-code-extension-security-notic...

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by darkwi11ow on Friday October 30, 2026 @08:08AM (#50302816)

Nah it was Anthropic, see my comment at https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi...

Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under Elon. But also it might be related to Anthropic/SpaceX business ties, they try to minimize damage on Anthropic pre-IPO

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by swingboy on Friday October 30, 2026 @08:13AM (#50302866)

Wasn’t it called Cursor Marketplace pre-Elon?

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by darkwi11ow on Friday October 30, 2026 @08:16AM (#50302891)

Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and Anthropic had never released a "Cursor Plugin"

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by mirashii on Friday October 30, 2026 @10:03AM (#50304053)

Cursor didn’t always use Open VSX, it changed in late 2025. https://forum.cursor.com/t/extension-marketplace-changes-tra...

Also worth noting that it doesn’t use Open VSX directly but uses a cursor hosted mirror at https://marketplace.cursorapi.com/open-vsx-mirror

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by darkwi11ow on Friday October 30, 2026 @10:08AM (#50304130)

Thanks for correction!

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by square_usual on Friday October 30, 2026 @10:09AM (#50304138)

From "I suspect it was Anthropic" to "Nah it was anthropic", it's amazing how disinformation spreads... when even your source says:

> but it is unclear whether his account or another part of the publishing process was compromised.

God, people get so conspiratorial on HN when it comes to Ant

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by JeremyNT on Friday October 30, 2026 @10:12AM (#50304186)

Direct link to Binance assertions you mentioned [0]

The Binance post should probably be the root link for this topic not this blog post - IMO

[0] https://www.binance.com/en/square/post/10-30-2026-claude-cod...

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by nmadden on Friday October 30, 2026 @12:20PM (#50306125)

That Binance post seems to not exist anymore - I get redirected to their homepage. Also doesn’t seem to be in the wayback machine.

Edit: found an archived copy: https://archive.is/AND7z

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by JeremyNT on Friday October 30, 2026 @01:30PM (#50307269)

The binance link still works for me? Maybe it's region blocked.

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by psychoslave on Friday October 30, 2026 @08:13AM (#50302860)

It's part of the plan to make you believe it is not as performant as what their flesh puppets pretend it to be. All these people in AI companies shown all the time on the web, did you ever met one?

The matrix has you Andrew.

I know, I should have launched a career in conspirationism.

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by qwrkll on Friday October 30, 2026 @10:44AM (#50304684)

As the article says, version 2.1.313 was silently deleted from OpenVSX, Visual Studio Marketplace and Cursor.

There is more going on here. Cursor is covering for Anthropic because of the huge data center contract with SpaceX.

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by literallyroy on Friday October 30, 2026 @11:20AM (#50305172)

No the version was skipped. 2.1.314 was published instead. Issue is with Cursor marketplace nothing else.

[ Parent | on HN ]

Re:Anthropic hacked to deliver remote access trojan by xvector on Friday October 30, 2026 @09:09PM (#50312242)

I wish I was schizophrenic enough to come up with conspiracies this interesting.

[ Parent | on HN ]