Anthropic got compromised.
-
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
@GossiTheDog It seems 2.1.313 is missing from Claude Code's GitHub repo too. https://news.ycombinator.com/item?id=50302650
No tag or mention in CHANGELOG.md for 2.1.313.
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog Stupid question: If AI is such a great tool to find bugs, flaws etc, as Anthropic keeps telling us again and again and again, why did it not find the backdoor in their own packages?
Must be a miracle happening
-
Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.
The plugin auto updates so every org will have been impacted.
@GossiTheDog was the Claude Code cli affected as well or are we cli users good? TBF I'm still running 2.1.301 because I haven't updated NixOS in a while
-
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
@GossiTheDog I expected a "Malicious official Claude Code extension on VScode" to be... louder?
I'm not sure if it was an incident beyond cursor marketplace. Enough time has passed to see more information if it was that large scale. -
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
RE: https://infosec.exchange/@RichardoC/117529759531517074
MacOS OSQuery hunting queries:
-
@GossiTheDog here's a detection #osquery for #macos, in case it helps anyone
https://gist.github.com/RichardoC/9753dfa5aeffc6a1201f5e57114f54ff
@RichardoC - how do we run this? can you give a brief?
-
@GossiTheDog I expected a "Malicious official Claude Code extension on VScode" to be... louder?
I'm not sure if it was an incident beyond cursor marketplace. Enough time has passed to see more information if it was that large scale.@moh53n @GossiTheDog to be honest I expected VScode incidents to be more common, has that happy extension wild west feel like browser extensions before people started trading in them.
-
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog This sentence needs a bit of proofreading:
"Anthropic has not informed customers, and the malicious version was silently deleted the backdoored version without telling anybody."
Also, it might be a good idea to include instructions what the potential victims show do, in order to detect whether they have been compromised:
macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
Windows:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" } -
@GossiTheDog What, Teams is down?
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog of course Anthropic got compromised.
In what reality was that ever not going to happen?
-
I've confirmed Binance use Claude Code on Cursor with this extension.
@molly0xfff
This thread might be interesting to you! -
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog Exactly why I wrote AI Playground. https://gitlab.com/cryptomilk/ai-playground
-
@GossiTheDog with no comms from Anthropic, are there any concrete recommendations? I can think of at least one person I know who might be impacted by this.
@huronbikes @GossiTheDog I'd go with:
Disconnect from any network
Save your data (only) to removable storage
Erase and reinstall from media.Essentially, 'Nuke it from orbit'
I recognise this might be a bit draconian for many, though. -
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog
Well I don't mind. -
FWIW the compromised version, 2.1.313, was removed from repos. 2.1.314 is the ‘fixed’ version.
@GossiTheDog only 2.1.313 was comprised, no previous versions?
-
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog richly ironic.
-
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog "Outside of highly unusual circumstances where Cursor was started with administrator privileges" wait don't the slop kiddies do
>sudo curl ... | bash
or
>docker import <url>
all the time? -
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
-
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
@GossiTheDog I don't find any indications that it was anything but a compromise of Cursor systems (proprietary plugin ingestion it seems) , I don't find anything that the official extension or OpenVSX would have carried the malicious version. What evidence have you found that it's bigger?
In addition VS Code has an default extension update block for 12h, so it wouldn't have been affected. -
RE: https://infosec.exchange/@RichardoC/117529759531517074
MacOS OSQuery hunting queries:
@GossiTheDog That phorion blog post only talks about the Cursor Marketplace version which I guess is a bit of an obscure place to get extensions from. Were the official Microsoft marketplace and OpenVSX affected?
