Comment by felixrieseberg
21 hours ago
Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:
Until that happens - it's almost like you have to delete any extension from the Cursor Store off of your Cursor instance - kind of a crapshoot what you are actually downloading, no?
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?
The core problem is that VScode extensions does not need to be signed at all. Mind boggling stupid design decision.
16 replies →
You want an AI company to care about IP? And you aren't being sarcastic?
Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension. If that’s really what happened then that needs to change, ASAP. Now that it has happened, IMHO, it is partly an Anthropic problem: the malware has their branding and their name on it, I don’t think they can just brush that off.
Does Cursor have some process that just scrapes Microsoft’s extension catalog and lists them in their own? If that’s hostile works then it’s broken and needs to be fixed.
I'm on my phone, "If that’s hostile works.." should be "If that’s how it works..."
1 reply →
> Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension.
Well, duh. From what I can tell, that’s literally the hack. A bad actor shipped an extension on the Cursor marketplace that wasn’t made by Anthropic.
3 replies →
Anthropic is desperately dependent on SpaceXSI's compute (which either party can cancel without cause, on short notice), they can't really tell SpaceXSI to do anything without ruining their IPO; or more Claude outages leading to users flocking to OpenAI, etc.
The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology exists for ages and prominently featured in all mainstream Linux distributions. Cursor, Anthropic and other openvsx users need to work with Eclipse Foundation to make this happen.
Leading companies need to be proactive in reducing these surface areas. For example, if anyone can submit an agent skill, plugin, or MCP server with Anthropic or OpenAI's name into a marketplace, it is an attack vector.
Are you claiming that the Cursor extension store - marketplace.cursorapi.com - does not add their own proxy to Open VSX?
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.
That's nonsense. If what felixrieseberg said is true this is very clearly a compromise of Cursor and not Anthropic. Trying to spin it as a compromise of Anthropic is absurd.
I don't think they're trying to spin this as Anthropic being compromised, but I do think they're correct in saying this is Anthropic's problem to deal with now, regardless of the fact that they're not responsible for the root cause.
9 replies →
If you decided to use an umbrella to protect something during a hurricane and umbrella breaks and your thing is ruined. Whose fault is that?
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).
That is not what was written; what was described was anthropic losing control over their cursor account - perhaps a key compromise, developer laptop compromise, or a fault in cursor, but of the three, the language suggests the first two.
1 reply →
+1.
1 reply →
I think he's saying (erroneously) Anthropic owns Cursor. Reading this claude.com page [1] hawking Cursor you could be forgiven for forming that impression.
[1]: https://claude.com/marketplace/agents-products/cursor
That is simply not how software works.
From the producer's side, sure, we[1]'re all pretty sympathetic to the fact that if you publish a library a bunch of random people will build bridging libraries for languages that you have no control over.
But from the consumer's side it is very much an expectation and if you find yourself in the situation above it's on you to make it very clear that such extensions and third party tools are unofficial.
In this particular case I think it's fair to say that Anthropic really dropped the ball on signaling that this was an unofficial third party tool.
1. We specifically being library and tool producers that are noticeably overrepresented on this forum.
3 replies →
The situation is confusing, so can I please confirm the following:
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
I am curious to see how difficult it will be to get this message across on Twitter. $44B seems like a bargain at this point.
2 replies →
This is not directed at you personally but Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
13 replies →
Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases:
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
[0] https://cursor.com/help/customization/extensions
It wasn't on OpenVSX according to https://news.ycombinator.com/item?id=50305148
there is NO LEGIT v2.1.313
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148
My guess is someone published an extension on vscode/cursor claiming to be Anthropic when it wasn't. Kind of like me publishing an app called Youtube on the app store, being accepted by Apple and having people download my malicious app called Youtube.
There's been too much guessing already. Anthropic employees answered in this thread almost 4h before your response.
Ok, so... Summing this up
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
Yeah, their blog post is not very transparent at what happened here. Does not instill trust.
Apparently it is public: https://cursor.com/help/customization/extensions
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"
Which is exactly the opposite of what happened today.
1 reply →
> Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours.
I think everyone is going to be setting this to 168 after today.
Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.
If this isn't a damning indictment of Cursor, I don't know what is. Perhaps it will be the death knell.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
Cursor was the first AI coding tool I used that had a "wow" factor and got me to switch over from typing out most of my code to having AI write most of it. But then when I used Claude Code for the first time, I never went back to Cursor.
I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.
Yeah, kind of eye raising if people are still using Cursor now days.
Seeing as SpaceX owns Curser, I’m surprised there wasn’t a hack on SpaceX… Yet
Who says there wasn't?
A lot of the most valuable SpaceX IP (at least to the big "advanced persistent threat" hackers) is probably related to military secrets, information to let you spy on/disable/control star shield/link, and so on. Not things we'd find out about as the general public.
1 reply →
I mean, who says it wasn't an inside job...
https://www.cnbc.com/2026/10/30/binance-hack-elon-musk-tesla...
>Perhaps it will be the death knell
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.
Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.
I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.
10 replies →
I forgot entirely about superfish. That takes me back.
My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.
I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.
I realized this earlier this year and dumped Cursor for just vscode along with 20x subs to Claude and OpenAI. Much cheaper and nothing of value was lost.
I believe the value add was $60bn in just 4 years https://www.linkedin.com/posts/sytaylor_wild-cursor-just-sol...
I dont know a single person who uses this tool (but im sure there are some) our annual subs recently ran out, I hadnt used mine in 6 months, we did not renew.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
10 replies →
[flagged]
[flagged]
I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?
Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.
Is the extension not Anthropic.claude-code developed by Anthropic? Been a while since I used Cursor.
1 reply →
The extensions does not need full access to the laptop.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
It shouldn't.
Be as close as AGI we are (/s), this issue from 2018 is still open:
https://github.com/microsoft/vscode/issues/52116
I don't know what we are doing.
Probably a good idea to only run LLMs with a dedicated user account, or in a container.
Dedicated user account does not work as eventually all your code and data will move under that.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.
5 replies →
For locally installed Code / Code-fork extensions, there is not any concept of permissions (at least on Windows or MacOS (+ the 3rd party code-server running on Linux)), correct?
Does it? It asks for permission to use whatever directory you call it in.
I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.
>I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.
why do people cry if you say "only"?
hey, personally i dont mind either, perhaps its because different words are used to frame things differently in different languages. A lot of people here type english but aren't.
I just said this as some unsolicited advice since out of experience i know it makes. a big difference to choose the right phrasing when speaking to people from around the globe.
I think the concern is that it could be seen as minimizing the harm done to those affected, but I personally think this is kind of a hypersensitive overcorrection :P
2 replies →
Nobody seems to be taking responsibility for the alluded-to credential leak. No ownership taken, and no explanation of how the leak occurred or how it will be prevented in the future.
If y'alls systems were not compromised then it was Cursors?
Why was version 2.1.313 silently deleted from OpenVSX, Visual Studio Marketplace and Cursor then?
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
313 was never released lol https://github.com/anthropics/claude-code/releases
I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.
Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.
Why was the npm version 2.1.313 yanked?
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
Thank you for the clarification and my apologies for misspeaking, as the version indeed does not appear to have been yanked but entirely absent.
Why such stuff isn't signed, like packages in every serious Linux distribution since decades?
smooth sloperators, smooooooooth sloperattorrrrrssss
All these security issues have made me want to build more of my own slimmed down tools. It would be great if there were better ways to use claude code with my own minimal harness and still have access to the pro plan.
> The versions on our official channels are not affected and this only impacts Cursor users.
Is Cursor not an official channel for Claude?
[flagged]
[flagged]
[flagged]
I think you’re being extremely negative towards Anthropic here. Basically the parent is saying “this is a problem at Cursor and not Anthropic” and you’re holding them accountable.
You’re literally saying that they should not have published on the Cursor marketplace but should have used OpenVSX because that would have been “reasonable”, but I think you’re being unreasonable here.
Are you really surprised they've created ill-will?
Since this morning I've seen a dozen "Anthropic hacked!!!" articles upvoted to the front page. There's really no use arguing with the mob. People will make up their own realities because they desperately want it to be true.
2 replies →
Dworken from Anthropic here, I just want to be clear: OpenVSX was not impacted in this incident, the impacted system was only the Cursor marketplace that they host. We have confirmed that no Anthropic systems or employee devices are involved in this.
Thanks for the clarification. Remaining question is then: why was version 2.1.313 yanked from both OpenVSX and the Cursor Marketplace then?
As discussed here:
https://cyberplace.social/@GossiTheDog/117528831681803563
and as can be seen as there is no version 2.1.313 here: https://open-vsx.org/extension/Anthropic/claude-code/2.1.313
but there is https://open-vsx.org/extension/Anthropic/claude-code/2.1.314 https://open-vsx.org/extension/Anthropic/claude-code/2.1.312
2 replies →
By this you mean Anthropic is now accountable to secure Elon's marketplace offerings. I'm not sure that is reasonable.
> We’re working with Cursor on this incident
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.