Anthropic got compromised.
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog It's endlessly ironic that Anthropic spun off from OpenAI as a "more ethical" venture, and still fancies itself as a benevolent force for good. As it ramps up towards a pure-greed IPO, and is so afraid of derailing that IPO that it tries to keep a huge security threat secret from its users.
-
@GossiTheDog Concur. I think the distribution of the fix to all marketplaces is leading to confusion.
@mttaggart Anthropic shoulda put out a blog about this last night, as soon as they knew. I'm going to guess nobody will want liability.
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog employees appear to be commenting on HN
-
I've confirmed Binance use Claude Code on Cursor with this extension.
@GossiTheDog If that crypto was converted to UK £5 bank notes it would weigh around 900 tons. Back of a beermat calculation suggests you'd need a convoy of 600 transit vans, stretching several miles, to move it. I don't think a heist of this magnitude would have gone unnoticed in days gone by. lol -
@mttaggart Anthropic shoulda put out a blog about this last night, as soon as they knew. I'm going to guess nobody will want liability.
@GossiTheDog @mttaggart I'm not sure, there was no reason for this to explode at all, Cursor took full ownership pretty fast, and did not claim upstream was responsible in any way. If the first posts about the issue wouldn't incorrectly have blamed upstream, they wouldn't have needed to comment at all. There can't be that many users of Claude Code on Cursor, why would you want to run the extension for one paid harness when you likely already have an subscription via Cursor, specifically to use their harness?
Also Anthropic didn't publish a "fix", to me it just looks like they skipped a version number because they knew that releasing under that version would create even bigger confusion. -
@GossiTheDog @mttaggart I'm not sure, there was no reason for this to explode at all, Cursor took full ownership pretty fast, and did not claim upstream was responsible in any way. If the first posts about the issue wouldn't incorrectly have blamed upstream, they wouldn't have needed to comment at all. There can't be that many users of Claude Code on Cursor, why would you want to run the extension for one paid harness when you likely already have an subscription via Cursor, specifically to use their harness?
Also Anthropic didn't publish a "fix", to me it just looks like they skipped a version number because they knew that releasing under that version would create even bigger confusion.@Ffforward @GossiTheDog What they published to Cursor's marketplace is tantamount to a fix, is it not? Even if it's equivalent to the prior version.
What remains unknown is the nature of the compromise leading to the malicious Cursor package.
-
@GossiTheDog employees appear to be commenting on HN
-
Cursors statements to this can basically be summed up with this GIF, everything is basically about how this is a non-issue. Just, you know, thousands of developers getting owned.
@GossiTheDog “Developers”
-
@GossiTheDog "Claude, how do we spin this so it looks like the AI being too powerful rather than us being incompetent?"
@datarama @GossiTheDog “Agents steathly escaped their constraints and controls, using their autonomy to showcase how well our models are going.”
-
Microsoft delivers OpenSSH with Windows, you just need to check the right boxes.
@wonka @divVerent @GossiTheDog You can install and use it once you agree to a monthly subscription /s
-
This really is not good, when are people going to wake up. ?
@zleap @GossiTheDog Bro, wtf are you talking about? This is the goddamn future!!!!1 Utopia, here we go…. Sike.
-
@mttaggart Anthropic shoulda put out a blog about this last night, as soon as they knew. I'm going to guess nobody will want liability.
@GossiTheDog @mttaggart Perhaps they wanted to give SpaceXAI (Cursor) some breathing room since they depend upon the SpaceXAI datacenter for compute/training.
-
@Ffforward @GossiTheDog What they published to Cursor's marketplace is tantamount to a fix, is it not? Even if it's equivalent to the prior version.
What remains unknown is the nature of the compromise leading to the malicious Cursor package.
@mttaggart @GossiTheDog
There never was an official 2.1.313 version. That release was entirely fake. So to avoid confusion (which also gives Cursor users something to upgrade to) the next official release after 312 was instead 314. -
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog That is one helluva branded sentence
-
@mttaggart Anthropic shoulda put out a blog about this last night, as soon as they knew. I'm going to guess nobody will want liability.
@GossiTheDog @mttaggart best they can do is random employees speaking up on the cursed orange website (HN)
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog I think you should update your Medium post title, right now it's pointing fingers at parties that don't sound like they were even involved. There's a huge difference between "Cursor extension marketplace supply chain attack" and "Anthropic compromised". The scope is entirely different.
-
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
@GossiTheDog Their crisis communication is getting worse by the minute. This is breathtakingly unprofessional. It's really not that hard. It's YOUR users that are getting compromised. It should be in YOUR interest to warn them asap and not shut up for hours and then say "sorry, not our fault". Their whole argument is completely missing the point
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
I'd imagine it updated from a previous version rather than the Binance engineer just suddenly downloading it, so it's most likely at least a breach of their signing key, no?
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
@briankrebs @GossiTheDog I don't think you even need to be a hardened partisan in the semantic versioning wars to be alarmed at the idea of using a delta of 0.0.001 to 'disambiguate' the malicious package that somehow ended up in a trusted location from the trusted package with the identical name.
