Anthropic got compromised.
-
@GossiTheDog That phorion blog post only talks about the Cursor Marketplace version which I guess is a bit of an obscure place to get extensions from. Were the official Microsoft marketplace and OpenVSX affected?
@guenther @GossiTheDog I'm pretty sure phorion silently edited their blog post, I'm sure the first version I saw this morning mentioned OpenVSX.
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog Claude Hopping?
-
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
-
@guenther @GossiTheDog I'm pretty sure phorion silently edited their blog post, I'm sure the first version I saw this morning mentioned OpenVSX.
@guenther @GossiTheDog They did:
https://web.archive.org/web/20261030072223/https://phorion.io/blog/offical-claude-code-vsx-compromise/(alt link in case wayback breaks
http://archive.today/2026.10.30-094019/https://web.archive.org/web/20261030072223/https://phorion.io/blog/offical-claude-code-vsx-compromise/) -
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog Looks like there a word missing in this sentence:
"Anthropic has not informed customers, and the malicious version was silently deleted the backdoored version without telling anybody."
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog
Wer ist den jetzt dafür verantwortlich, die Malwareleute oder Anthropic, oder die Allgemeinheit. Ich bin raus aus dem US Kram! Mit Wachsflügeln zur Sonne ist so Ikarusmäßig! -
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
@wdormann @GossiTheDog Unless Anthropic tells us what happened, I'd assume both were infected.
And based on experience, big AI companies tend to take 1 to 2 months until they inform anyone about security incidents, so I wouldn't expect this to happen soon.
-
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
@wdormann @GossiTheDog I wonder about Windsurf, which uses the VSCode marketplace.
-
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
@wdormann it took several hours to shake out the details but that looks to be the shape of it.
-
@wdormann @GossiTheDog I wonder about Windsurf, which uses the VSCode marketplace.
@huronbikes @GossiTheDog
I'm pretty sure that Windsurf uses the same Open VSX Registry that Cursor does. -
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
@GossiTheDog Who needs Anthropic?
-
@wdormann it took several hours to shake out the details but that looks to be the shape of it.
@GossiTheDog
Aren't there other consumers of the Open VSX Registry? In which case this incident is not limited to Cursor? -
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog I hope that all the financial analysts who are responsible for due diligence on the upcoming Anthropic public offering see both the report and Anthropic’s lack of response. The legal bills and reputation loss could be staggering.
-
@GossiTheDog
Aren't there other consumers of the Open VSX Registry? In which case this incident is not limited to Cursor?@wdormann so that bit is unclear. They have some kind of proxy to it apparently. At the minute Anthropic refuse to say anything - they no commented my blog too, and Cursor is busy trying to downplay that anything happened.
-
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog
in your medium post are some extraneous words:
“the malicious version was silently deleted the backdoored version” -
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog LOL
-
@GossiTheDog odds on this being a factor in how binance got done over?
Very likely, I'd say.
-
@wdormann so that bit is unclear. They have some kind of proxy to it apparently. At the minute Anthropic refuse to say anything - they no commented my blog too, and Cursor is busy trying to downplay that anything happened.
@GossiTheDog
Neat.If we look at the claude code tags in github (including searching git logs) or the Open VSX Registry, I see no mention of
2.1.313anywhere.There is one single github user that mentions 2.1.313 release notes in a sort of canned footer in 6 tickets that were all created 10 hours ago, though.
-
@datarama @GossiTheDog
"The agents went wild and wanted to expand to more computers" - definitely not "We vibe code our security"@cdamian @datarama @GossiTheDog
"The Basilisk wanted more funding. We have been informed that all those affected will be viewed with slightly less malice by the Basilisk, once its time comes"
-
@GossiTheDog
Neat.If we look at the claude code tags in github (including searching git logs) or the Open VSX Registry, I see no mention of
2.1.313anywhere.There is one single github user that mentions 2.1.313 release notes in a sort of canned footer in 6 tickets that were all created 10 hours ago, though.
@wdormann @GossiTheDog everyone has ceded software engineering to a firm which clearly knows nothing about software security and this is why we can’t have nice things
