Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize
(official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX
account with release privileges.
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.
Yeah OpenVSX security is a joke, they also have dumb search algorithm which
allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim
their proprietary VSCode marketplace to be more secure.
Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
A lot of this is turning into “well other company said” but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I’m confused.
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.
Now I'm glad I've not opened VSCodium in a few weeks; I prefer using Claude as a separate application anyways, will have to remove the extensions.
No evidence, but I do feel like the problem is going to be OpenVSX and not Anthropic.
The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
I am starting to have a hard time who is responsible for what. I no longer know what's the relationship between companies/products like Anthropic, Cursor, SpaceXAI, Copilot, etc.
Nobody seems to be taking responsibility yet for what exactly was compromised, how, and what steps are being taken to prevent it.
It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...
This could have been avoided by having extensions signed by company doing them with keys and review
Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim their proprietary VSCode marketplace to be more secure.
6 replies →
Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
A lot of this is turning into “well other company said” but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I’m confused.
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
1: https://news.ycombinator.com/item?id=50304585
Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.
Now I'm glad I've not opened VSCodium in a few weeks; I prefer using Claude as a separate application anyways, will have to remove the extensions. No evidence, but I do feel like the problem is going to be OpenVSX and not Anthropic.
1 reply →
You're ignoring the "or" which is doing a lot of work.
Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"
[flagged]
The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s
Vibecoders are safu
Boris: "By winter 2025, 100 percent of my code was written by Claude Code. Not a single line by hand."
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you
Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
You make a good point, my comment above probably overstates things.
There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
>Also, all their tags are immutable, and so can't just be deleted to hide things
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
2 replies →
I am starting to have a hard time who is responsible for what. I no longer know what's the relationship between companies/products like Anthropic, Cursor, SpaceXAI, Copilot, etc.
Nobody seems to be taking responsibility yet for what exactly was compromised, how, and what steps are being taken to prevent it.
It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.