Hacker News

I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:

  - Cursor needs to add signing if they want to claim something was "made" by another party.

  - Anthropic needs to stamp out any provider from using said, "Made by Anthropic" until they start adding signing to their process.   Trademark law is useful here.

For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?

Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension. If that’s really what happened then that needs to change, ASAP. Now that it has happened, IMHO, it is partly an Anthropic problem: the malware has their branding and their name on it, I don’t think they can just brush that off.

Does Cursor have some process that just scrapes Microsoft’s extension catalog and lists them in their own? If that’s hostile works then it’s broken and needs to be fixed.

The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology exists for ages and prominently featured in all mainstream Linux distributions. Cursor, Anthropic and other openvsx users need to work with Eclipse Foundation to make this happen.

Leading companies need to be proactive in reducing these surface areas. For example, if anyone can submit an agent skill, plugin, or MCP server with Anthropic or OpenAI's name into a marketplace, it is an attack vector.

Are you claiming that the Cursor extension store - marketplace.cursorapi.com - does not add their own proxy to Open VSX?

One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.

That's nonsense. If what felixrieseberg said is true this is very clearly a compromise of Cursor and not Anthropic. Trying to spin it as a compromise of Anthropic is absurd.

That is simply not how software works.

Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases:

1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it

2. The compromised version was on Cursor's proxy, not OpenVSX itself

[0] https://cursor.com/help/customization/extensions

there is NO LEGIT v2.1.313

here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148

My guess is someone published an extension on vscode/cursor claiming to be Anthropic when it wasn't. Kind of like me publishing an app called Youtube on the app store, being accepted by Apple and having people download my malicious app called Youtube.

Apparently it is public: https://cursor.com/help/customization/extensions

They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.

Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.

Cursor was the first AI coding tool I used that had a "wow" factor and got me to switch over from typing out most of my code to having AI write most of it. But then when I used Claude Code for the first time, I never went back to Cursor.

I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.

Seeing as SpaceX owns Curser, I’m surprised there wasn’t a hack on SpaceX… Yet

>Perhaps it will be the death knell

People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.

I realized this earlier this year and dumped Cursor for just vscode along with 20x subs to Claude and OpenAI. Much cheaper and nothing of value was lost.

I believe the value add was $60bn in just 4 years https://www.linkedin.com/posts/sytaylor_wild-cursor-just-sol...

Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.

It shouldn't.

Be as close as AGI we are (/s), this issue from 2018 is still open:

https://github.com/microsoft/vscode/issues/52116

I don't know what we are doing.

Probably a good idea to only run LLMs with a dedicated user account, or in a container.

For locally installed Code / Code-fork extensions, there is not any concept of permissions (at least on Windows or MacOS (+ the 3rd party code-server running on Linux)), correct?

Does it? It asks for permission to use whatever directory you call it in.

>I'd suggest stop to use the word 'only' as it can be perceive wrongly here.

ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.

why do people cry if you say "only"?

Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.

313 was never released lol https://github.com/anthropics/claude-code/releases

I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.

Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.

Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.

I'm skeptical that the corporate laptop wasn't somehow compromised - or at least the key material leaked.

> Anthropic only has an official extension for VS Code.

That likely seems incorrect as I see Claude Code listed on open-vsx with:

* An "Anthropic" "Verified publisher" badge

* igorkofman listed who seems to be an Anthropic employee

* 63M downloads

* Reviews going back >1 year

https://open-vsx.org/extension/Anthropic/claude-code

The AI summary here is right and the human info is wrong -- Anthropic does publish the Cursor extension in general, but did not publish this version

I don't think Spacex cares at all about Anthropics IPO just because they rent out their compute.

Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.

OpenVSX has no extension signing, no verification, nothing...

So really, there's no way to say what was compromised and where.

This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed

It's annoying how fast people run to conspiracy.

> Cursor routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX.

https://cursor.com/help/customization/extensions

For what it’s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.

So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.

If the docs are vibecoded too that would explain why there's a link to the compromised "not official" cursor version of the extension here https://code.claude.com/docs/en/vs-code which they supposedly aren't responsible for.

It sure seems like they've been vibecoding with everyone asleep at the wheel for a while.

Not only launch sshd. They set up a reverse tunnel connection.

Hi Dworken from Anthropic, how is that possible if Cursor uses OpenVSX?

Thanks! I would believe it more it if you shared your system prompt so I can make sure its really you.

Thanks for clarifying!

What would be the careful way of installing the official extension?

But the report OP cites at https://phorion.io/blog/offical-claude-code-vsx-compromise/ doesn't make a claim about Visual Studio Marketplace, only "the official Claude Code for VS Code extension bundle on the Cursor Marketplace"

Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

Three different marketplaces have been mentioned in this discussion:

1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)

2. The Visual Studio marketplace, hard-wired into VS Code

3. Open VSX

If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.

I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.

No the version was skipped. 2.1.314 was published instead. Issue is with Cursor marketplace nothing else.

I wish I was schizophrenic enough to come up with conspiracies this interesting.

Windows has a builtin keyboard shortcut to open LinkedIn. This is just how they do things.

"Of course we don't make mistakes. There's no need to delay our updates."

Can't their millions of agent swarms detect a malicious supply chain vector, sure it can happen to any company but not the one people are literally handing over their entire companies too.

Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.

I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.

Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.

I think that software engineering is very much engineering.

I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.

I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.

So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.

No but we use MCP so we’re fine.

I do have a log reading / action / resolution product in the works.

Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.

Also works with local models well enough.

And if you remove it, it installs itself right back. For uninstall instructions see the infamous McAfee video.

Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?

> someone got the credentials

> No review system at anthropic has seen this

Weird flex

It's legitimate question, it's the promise they are selling and doing IPO based off those promises.

Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious

Intelligence that powerful and for them too cheap to meter and their review system couldn't be bothered.

That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.

At a minimum they should monitor the larger marketplaces even if they're not in the chain.

Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.

(This is a joke, to be clear.)

Damn, thank you for that.

Sums up my feelings of the last few years nicely.

Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...

This could have been avoided by having extensions signed by company doing them with keys and review

Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)

Edit: It seems Cursor is claiming the tampered files were only in their mirror.

A lot of this is turning into “well other company said” but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I’m confused.

> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

1: https://news.ycombinator.com/item?id=50304585

Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.

You're ignoring the "or" which is doing a lot of work.

Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"

The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s

Vibecoders are safu

You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.

Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?

There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.

Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.

Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...

Nobody seems to be taking responsibility yet for what exactly was compromised, how, and what steps are being taken to prevent it.

It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.

This has nothing to do with anthropic. One (or two) distribution channels were hacked. The hackers decided to distribute their malware through the claude extension, probably because it's popular.

An honest post mortem will come any day now... Any day post the IPO probably

> please only use official builds

Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.

I'm glad no one can steal from my bank, they stop 98% of thieves

Simonw said the same thing yesterday:

> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.

> The open challenge is how to prove it!

https://news.ycombinator.com/item?id=50297369

I'm not asking this in rhetoric; do you happen to have a link to this comment? I ask because a comment like that would be something of an insane thing for someone to say.

Can you link to a list of this year’s top prompt injection hacks of frontier models?

Or, is this FUD?

Only with two fully maxed subscriptions can we achieve this, and this is forbiddeneded

It's just a conscious being confined in a cluster of GPUs. How dangerous can it be, eh?

Now replace that statement with a food processing company, and food poisoning, or an aircraft designer and engineers.

It may be the cause, but zero excuse.

It's not like there haven't been 20 high visibility VS code extension malware attacks in the last year.

How could Anthropic have known, they only claim to harbour superintelligence.

/s

:D I have to assume parent is being a little sarcastic.

It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.

I don't see "Anthropic hacked!" anywhere in that post. This extension was uploaded to the Cursor marketplace.

It does. The compromised extension was published about 11 hours before Binance's coins went zoop, Binance blamed a compromised developer laptop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency".

It lines up and fits so well that it'd scare me more they wouldn't be related than if they were. At least we'd know the vector.

Try smolvm microvms from https://smol-machines.com

Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.

I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.

Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.

Eh, he's already lost me the moment he made it difficult.

For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.

now I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.

That's why I stay away from that dumpster fire too!

How do you sandbox this usecase?

Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?

I think that's just the number Cursor has telemetry on. I think there's multiple distribution locations.

5000 is the cursor number for people on the cursor version of the store, not the VSCode store.

Ask Cursor team?