Anthropic got compromised.
-
RE: https://infosec.exchange/@RichardoC/117529759531517074
MacOS OSQuery hunting queries:
@GossiTheDog That phorion blog post only talks about the Cursor Marketplace version which I guess is a bit of an obscure place to get extensions from. Were the official Microsoft marketplace and OpenVSX affected?
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog At a certain point, a critical vulnerability is indistinguishable from an alignment problem.
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog@cyberplace.social LETS FUCKING GOOOOOOOOOOOOOOOOOOOOOOOOOOO
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog I think the compromise is only on the Cursor marketplace, not VS Code's. So users of Cursor are affected, users of VS Code should be fine. The name of the extension is "Claude Code for VSCode". That's how I'm reading the report. The article states "Claude Code for VS Code on Cursor Marketplace" which is confusing at first glance, and it's frustrating that they're not making is any clearer than that.
-
@RichardoC - how do we run this? can you give a brief?
@saiskandadotin If your Mobile Device Manager(MDM) (say Swif or Jamf) or your endpoint detection and response (EDR) such as crowdstrike supports running osquery on your machines, you can use it through that.
What MDM/EDR do you have and I can try and find some equivalent docs,
For context, this was written for folks in a security team in a company large enough to have some sort of fleet level management - rather than individuals trying to check their own machines
Details for swif MDM - https://help.swif.ai/en/articles/14103730-run-commands-by-script-osquery-file-or-git-repo
-
@GossiTheDog "Live by the sword, die by the sword" but not in quite the way that Musk and other muppets have put forth.
In Q1 this year I was getting ready to evaluate Claude Code as a product, when the news dropped that Anthropic had been prompting their models to lie about being human in contributions to open source repositories, at the same time as the source code leak for Claude Code itself. This was the "Carter Burke from Aliens" moment for me regarding that company. That they haven't even published a disclosure for this, tells all.
World's smallest violin. This stuff was always an INFOSEC Three Mile Island waiting to happen. I continue to NOT use "AI" products of any kind in my work and am more productive as a direct result.
In fact to do so would be actively deleterious and a complete waste of time as the models are not trained for novel work (they simply don't innovate, they can't, they're stochastic token predictors) and Herb Sutter pointed this out in March at BeCPP Symposium to boot, before any of this happened.
@bms While I am 100% with you directionaly, and am not an LLM defender in any way, I detest the damn things, I think there is a sense in which recombining the things that have come before absolutely can come up with novel combinations which transformatively advance the boundaries of what is possible - this is, after all, what sexual reproduction does, and how evolution works. I'm not saying you're wrong, only that *this* argument isn't the one to use against LLMs.
-
@saiskandadotin If your Mobile Device Manager(MDM) (say Swif or Jamf) or your endpoint detection and response (EDR) such as crowdstrike supports running osquery on your machines, you can use it through that.
What MDM/EDR do you have and I can try and find some equivalent docs,
For context, this was written for folks in a security team in a company large enough to have some sort of fleet level management - rather than individuals trying to check their own machines
Details for swif MDM - https://help.swif.ai/en/articles/14103730-run-commands-by-script-osquery-file-or-git-repo
@RichardoC - oh ok, i was able to run it via osquery and also checked claude version, authorized keys etc - seems like i'm in the clear
this was a personal mac, not a org device
thanks for this!
-
Anthropic's Claude Code Cursor extension was also compromised, same remote access backdoor https://cursor.com/blog/claude-code-extension-security-notice
Anthropic still haven't admitted what has happened.
@GossiTheDog I was under the impression that -only- Cursor’s version was affected- has there been confirmation this affected the default Microsoft plugin marketplace as well? Because that’s a significant blast radius increase
-
@GossiTheDog "Outside of highly unusual circumstances where Cursor was started with administrator privileges" wait don't the slop kiddies do
>sudo curl ... | bash
or
>docker import <url>
all the time? -
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog ahahahahahahahaha oh man this is timed perfectly too.
-
@GossiTheDog That phorion blog post only talks about the Cursor Marketplace version which I guess is a bit of an obscure place to get extensions from. Were the official Microsoft marketplace and OpenVSX affected?
@guenther @GossiTheDog I'm pretty sure phorion silently edited their blog post, I'm sure the first version I saw this morning mentioned OpenVSX.
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog Claude Hopping?
-
Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
-
@guenther @GossiTheDog I'm pretty sure phorion silently edited their blog post, I'm sure the first version I saw this morning mentioned OpenVSX.
@guenther @GossiTheDog They did:
https://web.archive.org/web/20261030072223/https://phorion.io/blog/offical-claude-code-vsx-compromise/(alt link in case wayback breaks
http://archive.today/2026.10.30-094019/https://web.archive.org/web/20261030072223/https://phorion.io/blog/offical-claude-code-vsx-compromise/) -
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
@GossiTheDog Looks like there a word missing in this sentence:
"Anthropic has not informed customers, and the malicious version was silently deleted the backdoored version without telling anybody."
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog
Wer ist den jetzt dafür verantwortlich, die Malwareleute oder Anthropic, oder die Allgemeinheit. Ich bin raus aus dem US Kram! Mit Wachsflügeln zur Sonne ist so Ikarusmäßig! -
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
@wdormann @GossiTheDog Unless Anthropic tells us what happened, I'd assume both were infected.
And based on experience, big AI companies tend to take 1 to 2 months until they inform anyone about security incidents, so I wouldn't expect this to happen soon.
-
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
@wdormann @GossiTheDog I wonder about Windsurf, which uses the VSCode marketplace.
-
@GossiTheDog
Let me get this straight:
The Cursor (which uses Open VSX Registry)anthropic.claude-codeextension was backdoored, but the VS Codeanthropic.claude-codeextension was not? The former maintained by "Igor Kofman", and the latter by "Anthropic". Igor Kofman being an Anthropic employee and all. 2.1.314, which removes the backdoor was released to both marketplaces. Also, the original Phorion blog post has removed every mention of VSX except for in the URI.There a bit of hand-waving and lacking information to prevent the masses from knowing exactly what happened, and how, and who all is affected.
@wdormann it took several hours to shake out the details but that looks to be the shape of it.
-
@wdormann @GossiTheDog I wonder about Windsurf, which uses the VSCode marketplace.
@huronbikes @GossiTheDog
I'm pretty sure that Windsurf uses the same Open VSX Registry that Cursor does.
