Comment by bostik
17 hours ago
This is not directed at you personally but Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
Anthropic needs to issue a cease and desist to Cursor for claiming official “by Anthropic” extensions they don’t make or control.
They would have done this in a heartbeat to anyone that they’re not reliant on for compute.
> But Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
Anthropic is incapable of communicating. They rely on random employees in random threads on random social media to do some kind of PR and posts. Regardless of the issue. Or even non-issues but features.
[flagged]
I'd try to be less cynical in life. We have an engineer here willing to communicate with people, and people should seize that moment.
You're confused. It's not Anthropic's responsibility to monitor and fix everything that's said correctly or incorrectly about them. They're doing excellent given what they're capable to do in this situation.
You run a business and have millions of high paying customers. Someone happens to use your brand to market things and create harm for the society. Legally, you may be clean. But, your first line of defense is not "it is not my problem".
Yeah, but every now and then someone working for Anthropic tweets something, everyone quotes it as gospel, but there's no official statement anywhere on their website. They have the worst communication ever, it's one of the things I like the least about Anthropic.
It’s strictly speaking not their responsibility, but it is something that they should do if they want to help their customers.
In general, they need to make a really big post somewhere that’s not a HN comment that this was in fact a compromise of the Cursor marketplace, not an employee’s machine, because they’re getting a lot of (unjustified) bad PR.
They're not obligated to. I'm not obligated to be a customer.
No but their no doubt highly paid lawyers should have sought relief from their trademark being infringed, and demanded the extension was pulled long ago.
They didn't because they were benefitting from the situation. (Users got to use their preferred tooling.) Until they weren't. That makes it more their problem, in my mind.