Comment by tzone
15 hours ago
You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:
Until that happens - it's almost like you have to delete any extension from the Cursor Store off of your Cursor instance - kind of a crapshoot what you are actually downloading, no?
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?
The core problem is that VScode extensions does not need to be signed at all. Mind boggling stupid design decision.
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
11 replies →
i work for a large company that’s trying to curate vs code extensions, and this doesn’t make it easy.
we automatically block extensions and require that extensions must be approved, but this is a tedious process.
Is there finally a use for blockchain?
2 replies →
You want an AI company to care about IP? And you aren't being sarcastic?
Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension. If that’s really what happened then that needs to change, ASAP. Now that it has happened, IMHO, it is partly an Anthropic problem: the malware has their branding and their name on it, I don’t think they can just brush that off.
Does Cursor have some process that just scrapes Microsoft’s extension catalog and lists them in their own? If that’s hostile works then it’s broken and needs to be fixed.
I'm on my phone, "If that’s hostile works.." should be "If that’s how it works..."
I mean the initial translation kind of works too.
> Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension.
Well, duh. From what I can tell, that’s literally the hack. A bad actor shipped an extension on the Cursor marketplace that wasn’t made by Anthropic.
No, you misunderstand (not surprising since 99% of the coverage on this story is wrong). What happened is: someone published an extension called "Anthropic.claude-code". That someone was not Anthropic and never was Anthropic. They just used the string "Anthropic" in the name of their extension. The comment you are responding to is saying that Cursor (the organization that manages the extension marketplace) should have prohibited someone from using a popular AI lab's name in the title of their mystery meat extension. They're probably right about that.
2 replies →
The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology exists for ages and prominently featured in all mainstream Linux distributions. Cursor, Anthropic and other openvsx users need to work with Eclipse Foundation to make this happen.
Leading companies need to be proactive in reducing these surface areas. For example, if anyone can submit an agent skill, plugin, or MCP server with Anthropic or OpenAI's name into a marketplace, it is an attack vector.
Anthropic is desperately dependent on SpaceXSI's compute (which either party can cancel without cause, on short notice), they can't really tell SpaceXSI to do anything without ruining their IPO; or more Claude outages leading to users flocking to OpenAI, etc.
Are you claiming that the Cursor extension store - marketplace.cursorapi.com - does not add their own proxy to Open VSX?
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.
That's nonsense. If what felixrieseberg said is true this is very clearly a compromise of Cursor and not Anthropic. Trying to spin it as a compromise of Anthropic is absurd.
I don't think they're trying to spin this as Anthropic being compromised, but I do think they're correct in saying this is Anthropic's problem to deal with now, regardless of the fact that they're not responsible for the root cause.
It’s like if 5,000 people bought iPhones at Costco and they all exploded, and Apple says “well we didn’t sell them.” Sure, but maybe not the perfect thing to communicate immediately.
8 replies →
If you decided to use an umbrella to protect something during a hurricane and umbrella breaks and your thing is ruined. Whose fault is that?
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).
That is not what was written; what was described was anthropic losing control over their cursor account - perhaps a key compromise, developer laptop compromise, or a fault in cursor, but of the three, the language suggests the first two.
This is wrong.
+1.
HN has a dedicated upvote functionality.
I think he's saying (erroneously) Anthropic owns Cursor. Reading this claude.com page [1] hawking Cursor you could be forgiven for forming that impression.
[1]: https://claude.com/marketplace/agents-products/cursor
That is simply not how software works.
From the producer's side, sure, we[1]'re all pretty sympathetic to the fact that if you publish a library a bunch of random people will build bridging libraries for languages that you have no control over.
But from the consumer's side it is very much an expectation and if you find yourself in the situation above it's on you to make it very clear that such extensions and third party tools are unofficial.
In this particular case I think it's fair to say that Anthropic really dropped the ball on signaling that this was an unofficial third party tool.
1. We specifically being library and tool producers that are noticeably overrepresented on this forum.
> Anthropic really dropped the ball on signaling that this was an unofficial third party tool
Had the tool been up longer than the 11 hours the malware was live? If not, then why would Anthropic try to get it marked as unofficial, as opposed to take it down?
Or are you saying that every author and publisher should request Cursor to mark their extensions on the Cursor vsx pass-through as unofficial?
[flagged]
1 reply →