Anthropic got compromised.
-
I've confirmed Binance use Claude Code on Cursor with this extension.
@GossiTheDog wow
-
Anthropic won't comment, nor are account managers.
-
@Gaelan @GossiTheDog because they published the clean 2.1.314 release in VS Code marketpace as well, I think
-
@GossiTheDog im all for vibecoders getting hacked
@arfy@fedi.catto.garden @GossiTheDog@cyberplace.social couldn't happen to a nicer bunch of cunts
-
Anthropic won't comment, nor are account managers.
-
@GossiTheDog "Claude, how do we spin this so it looks like the AI being too powerful rather than us being incompetent?"
-
@GossiTheDog I'm having the best week of schadenfreude, I swear...
-
@GossiTheDog That is wild!!
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog the Phorion blog focuses on Cursor. Are you sure this also affected the default marketplace in stock VS Code?
-
@GossiTheDog Are we sure yet that the open-vsx was actually affected?
Phorion claims so, but Cursor claims that it was only their marketplace and not open-vsx
https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor@Frekason @GossiTheDog And actually, same question about Microsoft's marketplace. Phorion only seems to mention Cursor's Marketplace.
-
@GossiTheDog "Claude, how do we spin this so it looks like the AI being too powerful rather than us being incompetent?"
@datarama @GossiTheDog
"The agents went wild and wanted to expand to more computers" - definitely not "We vibe code our security" -
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
@GossiTheDog I'm probably the 15th one to ask you that, but it is super unclear to me right now what the source of the bad update is.
Is it directly Anthropic? Or a rando repackaging the extension for 3rd party marketspaces? The cursor post says the extension wasn't developed by Anthropic.It's very bad because the extension is de-facto the one everyone uses, but I'm trying to understand who got popped first.
-
@Gaelan @GossiTheDog well, they probably wouldn't be able to publish actual 2.1.313 for cursor/openvsx/whatever so they'd have to skip it to avoid per-marketplace versioning lmao
-
Anthropic won't comment, nor are account managers.
@GossiTheDog At the moment, Anthropic has its hands on its ears while loudly singing Lalalalala.
-
@Gaelan @GossiTheDog well, they probably wouldn't be able to publish actual 2.1.313 for cursor/openvsx/whatever so they'd have to skip it to avoid per-marketplace versioning lmao@Gaelan @GossiTheDog unpublished extension would probably stay visible in vscode marketplace code.visualstudio.com/api/working-with-extensions/publishing-extension#unpublishing-extensions
-
@GossiTheDog It turns out that having good LLMs doesn't automatically make you good at cybersecurity. Who knew?
-
@GossiTheDog Even after update, I would say there is a risk that orgs have had other backdoors created, that persists the update
@nieldk @GossiTheDog Backdoor access ONCE means "nuke from orbit, it's the only way to be sure."
-
Anthropic won't comment, nor are account managers.
@GossiTheDog I'm sure they'll make an announcement after the IPO.
-
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
@GossiTheDog So this affects every VSCodium installing the extension from the Cursor marketplace?
-
@GossiTheDog the supply chain compromise could (is going to) be immense, and even tagging which LLM was used for what (open source and publicly available) code isn't enough (and with all those that do not disclose AI use or projects that don't require disclosure)... Air gap everything and update nothing? x/
@jt_rebelo @GossiTheDog Even that requires using only a fixed and known set of USB devices, printers, etc.
At the Snowden level EVERY networked machine is treated as presumed malicious. That means logging into anything even in a fucking library requires a one-time access code, the works.
