Anthropic got compromised.
-
Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.
The plugin auto updates so every org will have been impacted.
@GossiTheDog I wonder if they have CRA reporting obligations or not.
-
Anthropic won't comment, nor are account managers.
nitpicking: It's not Visual Studio, the advisory is for VS Code (entirely different product). Last time I checked there wasn't a Claude extension for Visual Studio 2026. -
@GossiTheDog It’s the Cursor and OpenVSX marketplaces which had the malware versions, but not the VSCode marketplace?
from the article at the very top:
> Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence.
-
I've confirmed Binance use Claude Code on Cursor with this extension.
@GossiTheDog wow
-
Anthropic won't comment, nor are account managers.
-
@Gaelan @GossiTheDog because they published the clean 2.1.314 release in VS Code marketpace as well, I think
-
@GossiTheDog im all for vibecoders getting hacked
@arfy@fedi.catto.garden @GossiTheDog@cyberplace.social couldn't happen to a nicer bunch of cunts
-
Anthropic won't comment, nor are account managers.
-
@GossiTheDog "Claude, how do we spin this so it looks like the AI being too powerful rather than us being incompetent?"
-
@GossiTheDog I'm having the best week of schadenfreude, I swear...
-
@GossiTheDog That is wild!!
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog the Phorion blog focuses on Cursor. Are you sure this also affected the default marketplace in stock VS Code?
-
@GossiTheDog Are we sure yet that the open-vsx was actually affected?
Phorion claims so, but Cursor claims that it was only their marketplace and not open-vsx
https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor@Frekason @GossiTheDog And actually, same question about Microsoft's marketplace. Phorion only seems to mention Cursor's Marketplace.
-
@GossiTheDog "Claude, how do we spin this so it looks like the AI being too powerful rather than us being incompetent?"
@datarama @GossiTheDog
"The agents went wild and wanted to expand to more computers" - definitely not "We vibe code our security" -
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
@GossiTheDog I'm probably the 15th one to ask you that, but it is super unclear to me right now what the source of the bad update is.
Is it directly Anthropic? Or a rando repackaging the extension for 3rd party marketspaces? The cursor post says the extension wasn't developed by Anthropic.It's very bad because the extension is de-facto the one everyone uses, but I'm trying to understand who got popped first.
-
@Gaelan @GossiTheDog well, they probably wouldn't be able to publish actual 2.1.313 for cursor/openvsx/whatever so they'd have to skip it to avoid per-marketplace versioning lmao
-
Anthropic won't comment, nor are account managers.
@GossiTheDog At the moment, Anthropic has its hands on its ears while loudly singing Lalalalala.
-
@Gaelan @GossiTheDog well, they probably wouldn't be able to publish actual 2.1.313 for cursor/openvsx/whatever so they'd have to skip it to avoid per-marketplace versioning lmao@Gaelan @GossiTheDog unpublished extension would probably stay visible in vscode marketplace code.visualstudio.com/api/working-with-extensions/publishing-extension#unpublishing-extensions
-
@GossiTheDog It turns out that having good LLMs doesn't automatically make you good at cybersecurity. Who knew?
-
@GossiTheDog Even after update, I would say there is a risk that orgs have had other backdoors created, that persists the update
@nieldk @GossiTheDog Backdoor access ONCE means "nuke from orbit, it's the only way to be sure."
