* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
In general, they need to make a really big post somewhere that’s not a HN comment that this was in fact a compromise of the Cursor marketplace, not an employee’s machine, because they’re getting a lot of (unjustified) bad PR.
Anthropic is incapable of communicating. They rely on random employees in random threads on random social media to do some kind of PR and posts. Regardless of the issue. Or even non-issues but features.
They would have done this in a heartbeat to anyone that they’re not reliant on for compute.
This time they say they didn’t do it. That might be true or maybe that employees credential was compromised. We don’t actually have facts yet.
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Which is exactly the opposite of what happened today.
I think everyone is going to be setting this to 168 after today.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
A lot of the most valuable SpaceX IP (at least to the big "advanced persistent threat" hackers) is probably related to military secrets, information to let you spy on/disable/control star shield/link, and so on. Not things we'd find out about as the general public.
China has probably being doing so for a decade.
https://www.cnbc.com/2026/10/30/binance-hack-elon-musk-tesla...
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.
I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.
I mean, LastPass is still in business...
> I mean, LastPass is still in business...
I mean, Microsoft is still experiencing massive growth.
"Do you use crowdstrike falcon?"
Their Linux stuff has gotten much better but besides the (insanely huge) recent windows debacle I've found them to be a great product
Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.
> the service ran as root, it UPDATED ITS OWN BINARIES as root!
Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
> Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
On any Linux distribution, which managed packages update themselves? zero. Crowdstrike should provide package repositories so admins can pull in updates at their regular cadence.
At a minimum, the package should NEVER update its own binaries located in /usr/bin or /opt. If it need to pull updates, those should go in /var. Crowdstrike could have made the core binaries a shim where they load a second stage from /var.
My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.
I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
I wouldn't say it's obviously unsuccessful.
(I realize it doesn't matter to those of you with a rather "lo-res" perspective on things. To put it in a nice way.)
(you could have left out your little jab. it adds nothing to the conversation except flavoring your comment with smugness)
It's interesting what is considered acceptable and what isn't.
Age-based bigotry, the most acceptable of bigotries!
I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.
It is not because I don't like Cursor or have found something better, just because I see things like no OpenAI models going forward, a push for Grok, and the stuff that xAI did in the past.
Before Cursor, I used vim + tmux.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
Be as close as AGI we are (/s), this issue from 2018 is still open:
https://github.com/microsoft/vscode/issues/52116
I don't know what we are doing.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.
When you run a linter, for example, then it should stop executing cider once it stops. And not be able to spawn long-running background tasks for infiltration.
E.g. when working on a frontend only project, you don't need to mount the backend directory and vice-versa. This limits the attack radius.
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...
You’re literally saying that they should not have published on the Cursor marketplace but should have used OpenVSX because that would have been “reasonable”, but I think you’re being unreasonable here.
As discussed here:
https://cyberplace.social/@GossiTheDog/117528831681803563
and as can be seen as there is no version 2.1.313 here: https://open-vsx.org/extension/Anthropic/claude-code/2.1.313
but there is https://open-vsx.org/extension/Anthropic/claude-code/2.1.314 https://open-vsx.org/extension/Anthropic/claude-code/2.1.312
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.
Is Cursor not an official channel for Claude?
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.
ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.
why do people cry if you say "only"?
its a bad thing to assume that everyone is the same here and have some default reactions.
these are people who in name of company are responding to customer concerns, unlike us who are simply commenting on stuff. its a different context to communicate from.
what do you think will be nhe result if they word things clumsily, people get angry, and then stop their subscriptions. Its not a handy thing to be doing. Big tech can be harsh, ive seen people sacked for less.
I just said this as some unsolicited advice since out of experience i know it makes. a big difference to choose the right phrasing when speaking to people from around the globe.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
- Cursor needs to add signing if they want to claim something was "made" by another party.
- Anthropic needs to stamp out any provider from using said, "Made by Anthropic" until they start adding signing to their process. Trademark law is useful here.
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?
Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...
Just a few days left! Looking forward.
This is going to cause some major argument between the EU and the US, maybe even a trade war. Trouble is already underway:
https://www.reuters.com/legal/government/us-lawmakers-urge-t...
Despite that I also think that this is the right and long overdue move on the EU side. We need to break the basic pattern that nobody cares as long as the responsible effectively never get the bill when they mess up.
Software is "Unsafe at Any Speed" [ https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed ] to bring a striking analogy — even we have since about 60 years the tech to build software which provably (in the mathematical sense) matches its specification. Still what you have on the market is utter garbage, and instead of getting better it gets currently actually worse with lowering the garbage quality level even more with "AI" slop. That EU legislation could become the escape hatch; that's why I'm looking forward.
Under the new legislation software products become regular products; there is no liability exception any more.
If you commercially distribute defective products to end user you're in general liable for the damages these defective products cause. This now includes pure software just as any other (physical) product on the market.
If you don't know how product liability generally works in the EU, and what this means for software see here:
https://cms.law/en/int/publication/the-new-eu-product-liabil...
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.
Scanning is a curious one. It's not always obvious because developer tools have legitimate reasons to do a lot of these things. LLMs are better at understanding what it's actually doing now though so that might have worked. But who knows, people have snuck in backdoors into many things before.
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
we automatically block extensions and require that extensions must be approved, but this is a tedious process.
Stop trying to make blockchain happen, it's not going to happen.
Does Cursor have some process that just scrapes Microsoft’s extension catalog and lists them in their own? If that’s hostile works then it’s broken and needs to be fixed.
Well, duh. From what I can tell, that’s literally the hack. A bad actor shipped an extension on the Cursor marketplace that wasn’t made by Anthropic.
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.
Apple would be 100% right to say "they're not our phone, we didn't make them, the branding was a lie."
Of course if Cursor actually has a direct connection with Anthropic, and Anthropic lost control of their keys... it's a different story and their employee is just obfuscating up there.
And there was no interception. At the very strongest, the bad guys convinced Cisco to ship the stuff, and Cisco is saying it’s not their responsibility.
They definitely shipped something they didn’t build or check.
So for the analogy, it really is like Costco didn't make any attempt to check they were buying actual iPhones.
If Costco made iPhones under license from Apple outside of the Apple supply chain and they all exploded, while the Apple name is involved they have no direct liability or responsibility.
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).
But from the consumer's side it is very much an expectation and if you find yourself in the situation above it's on you to make it very clear that such extensions and third party tools are unofficial.
In this particular case I think it's fair to say that Anthropic really dropped the ball on signaling that this was an unofficial third party tool.
1. We specifically being library and tool producers that are noticeably overrepresented on this forum.
Had the tool been up longer than the 11 hours the malware was live? If not, then why would Anthropic try to get it marked as unofficial, as opposed to take it down?
Or are you saying that every author and publisher should request Cursor to mark their extensions on the Cursor vsx pass-through as unofficial?
If y'alls systems were not compromised then it was Cursors?
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.