Anthropic got compromised.
-
RE: https://infosec.exchange/@RichardoC/117529759531517074
MacOS OSQuery hunting queries:
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
This really is not good, when are people going to wake up. ?
-
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
@GossiTheDog So it is all Elons fault?
-
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
Cursors statements to this can basically be summed up with this GIF, everything is basically about how this is a non-issue. Just, you know, thousands of developers getting owned.
-
@h4890
> the world IT-workers have gotten mind wipedYes. All not wiped enough were fired, some smart ones still cling to the desks but are in hiding, pretending they also were ai-debrained.
@ohir @GossiTheDog Unrelated, but once the companies have vibe coded themselves into a corner, the hiring will start again.
This is just the market, over time, optimizing resource use. In the short run it is painful, but in the long run necessary for the survival of the human race.
-
Cursors statements to this can basically be summed up with this GIF, everything is basically about how this is a non-issue. Just, you know, thousands of developers getting owned.
@GossiTheDog yep, consider each of those 5000 have access to production pipelines and servers... both... the own ones and customer ones....
-
Cursors statements to this can basically be summed up with this GIF, everything is basically about how this is a non-issue. Just, you know, thousands of developers getting owned.
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
-
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
@GossiTheDog do we believe anthropic?
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog So you have confirmation that the malicious package was uploaded to all of the extension marketplaces, not just Cursor?
-
I've confirmed Binance use Claude Code on Cursor with this extension.
@GossiTheDog Wow, they really did a swell job of shooting their own dicks off
-
@GossiTheDog So you have confirmation that the malicious package was uploaded to all of the extension marketplaces, not just Cursor?
@mttaggart nope, Anth won't comment about how far it got. I just know Anthropic published a new version, which no changes from the untampered version, to OpenVSX and VSCode Marketplace last night when all this kicked off and then didn't tell anybody there was a problem.
-
@mttaggart nope, Anth won't comment about how far it got. I just know Anthropic published a new version, which no changes from the untampered version, to OpenVSX and VSCode Marketplace last night when all this kicked off and then didn't tell anybody there was a problem.
@GossiTheDog Yeah there's some confusion here, because as Socket notes, the upload should leave a footprint: https://socket.dev/blog/claude-code-extension-compromise?utm_medium=feed#Open-VSX-Has-No-Publication-Record-for-2.1.313
-
@GossiTheDog Yeah there's some confusion here, because as Socket notes, the upload should leave a footprint: https://socket.dev/blog/claude-code-extension-compromise?utm_medium=feed#Open-VSX-Has-No-Publication-Record-for-2.1.313
@mttaggart my feeling is the exposure is purely for Cursor users. Unclear how it happened. Cursor has a proxy to OpenVSX so all extensions there work in Cursor.
-
@mttaggart my feeling is the exposure is purely for Cursor users. Unclear how it happened. Cursor has a proxy to OpenVSX so all extensions there work in Cursor.
@GossiTheDog Concur. I think the distribution of the fix to all marketplaces is leading to confusion.
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog It's endlessly ironic that Anthropic spun off from OpenAI as a "more ethical" venture, and still fancies itself as a benevolent force for good. As it ramps up towards a pure-greed IPO, and is so afraid of derailing that IPO that it tries to keep a huge security threat secret from its users.
-
@GossiTheDog Concur. I think the distribution of the fix to all marketplaces is leading to confusion.
@mttaggart Anthropic shoulda put out a blog about this last night, as soon as they knew. I'm going to guess nobody will want liability.
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog employees appear to be commenting on HN
-
I've confirmed Binance use Claude Code on Cursor with this extension.
@GossiTheDog If that crypto was converted to UK £5 bank notes it would weigh around 900 tons. Back of a beermat calculation suggests you'd need a convoy of 600 transit vans, stretching several miles, to move it. I don't think a heist of this magnitude would have gone unnoticed in days gone by. lol -
@mttaggart Anthropic shoulda put out a blog about this last night, as soon as they knew. I'm going to guess nobody will want liability.
@GossiTheDog @mttaggart I'm not sure, there was no reason for this to explode at all, Cursor took full ownership pretty fast, and did not claim upstream was responsible in any way. If the first posts about the issue wouldn't incorrectly have blamed upstream, they wouldn't have needed to comment at all. There can't be that many users of Claude Code on Cursor, why would you want to run the extension for one paid harness when you likely already have an subscription via Cursor, specifically to use their harness?
Also Anthropic didn't publish a "fix", to me it just looks like they skipped a version number because they knew that releasing under that version would create even bigger confusion. -
@GossiTheDog @mttaggart I'm not sure, there was no reason for this to explode at all, Cursor took full ownership pretty fast, and did not claim upstream was responsible in any way. If the first posts about the issue wouldn't incorrectly have blamed upstream, they wouldn't have needed to comment at all. There can't be that many users of Claude Code on Cursor, why would you want to run the extension for one paid harness when you likely already have an subscription via Cursor, specifically to use their harness?
Also Anthropic didn't publish a "fix", to me it just looks like they skipped a version number because they knew that releasing under that version would create even bigger confusion.@Ffforward @GossiTheDog What they published to Cursor's marketplace is tantamount to a fix, is it not? Even if it's equivalent to the prior version.
What remains unknown is the nature of the compromise leading to the malicious Cursor package.
