No, it's like 5,000 people bought something that Costco called the iPhone but really was EvilPhone Max+ by EvilCorp. Costco should be on the hook for accepting the phones without properly checking they weren't bombs in disguise.

Apple would be 100% right to say "they're not our phone, we didn't make them, the branding was a lie."

Of course if Cursor actually has a direct connection with Anthropic, and Anthropic lost control of their keys... it's a different story and their employee is just obfuscating up there.

It's a lot more like a bunch of people bought Cisco networking equipment and then the NSA secretly intercepted shipments, implanted surveillance backdoors, then resealed the boxes and sent them on to unsuspecting overseas targets.

If there are no seals at all then it’s hard to argue this is the correct analogy.

And there was no interception. At the very strongest, the bad guys convinced Cisco to ship the stuff, and Cisco is saying it’s not their responsibility.

They definitely shipped something they didn’t build or check.

This is misleading; a better analogy would be if someone swapped out all iPhones in the store with fake ones.

In this situation, Cursor did not make any reasonable attempts to check this extension really was from anthropic.

So for the analogy, it really is like Costco didn't make any attempt to check they were buying actual iPhones.

A better analogy would be to say Anthropic must register their domain with every TLD available, to prevent someone cybersquatting it. I see Claude.org.nz is available.

It's literally not like that at all.

If Costco made iPhones under license from Apple outside of the Apple supply chain and they all exploded, while the Apple name is involved they have no direct liability or responsibility.

Legal responsibility, no. But apple's reputation would nevertheless be on the line. Is this situation I would expect Apple to pursue legal action against Costco for reputational damage, as I would Anthropic Cursor.