Anthropic got compromised.
-
Anthropic themselves published the 'fixed' versions overnight on OpenVSX and VSCode Marketplace, and chose not to tell anybody what had happened.
@GossiTheDog I think you should update your Medium post title, right now it's pointing fingers at parties that don't sound like they were even involved. There's a huge difference between "Cursor extension marketplace supply chain attack" and "Anthropic compromised". The scope is entirely different.
-
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
@GossiTheDog Their crisis communication is getting worse by the minute. This is breathtakingly unprofessional. It's really not that hard. It's YOUR users that are getting compromised. It should be in YOUR interest to warn them asap and not shut up for hours and then say "sorry, not our fault". Their whole argument is completely missing the point
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
I'd imagine it updated from a previous version rather than the Binance engineer just suddenly downloading it, so it's most likely at least a breach of their signing key, no?
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
@briankrebs @GossiTheDog I don't think you even need to be a hardened partisan in the semantic versioning wars to be alarmed at the idea of using a delta of 0.0.001 to 'disambiguate' the malicious package that somehow ended up in a trusted location from the trusted package with the identical name.
-
Cursors statements to this can basically be summed up with this GIF, everything is basically about how this is a non-issue. Just, you know, thousands of developers getting owned.
@GossiTheDog they're terrified about being clean for that opening bell
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
@briankrebs @GossiTheDog
Ah, lovely. Very important thing that is affecting a company's reputation, with customers afraid. What do we do? Have a rando user post a statement on Hacker News. -
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
@GossiTheDog aren't these things signed by anthropic outside of cursor?
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog Terminator Bowser Dark Vador 3000 extension on Sauron has malware in it!
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
@briankrebs @GossiTheDog They could end this confusion with a simple, official statement or blog post to elaborate on the scope of this, considering how concerning and vague it was.
Yet our best official comment is an unofficial comment on HN. Perfection. -
@briankrebs @GossiTheDog
Ah, lovely. Very important thing that is affecting a company's reputation, with customers afraid. What do we do? Have a rando user post a statement on Hacker News.@wdormann @briankrebs @GossiTheDog It was blown to giant proportions to start with. For some reason some people that pays for the Cursor LLM harness want to use the Claude Code LLM harness inside the other LLM harness (??) from this proprietary open source mess that Musk thought was worth $60 billion. Cursor has some kind stupid proxy in front of Open VSX that they use to look like VS Code to defend their value, and this was abused to publish a fake release to a couple of thousand users. This release contains a backdoor that seems to be broken. It's literally the least important thing people need to worry about right now, so I understand that Anthropic, that literally has nothing to do with it, didn't feel any big urge to comment when Cursor already had taken 100% ownership of the compromise and issue.
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog XDDDD
-
Updated my blog with a statement from Anthropic, they say the breach was at Cursor:
"A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this".
The extension in Cursor itself shows as published by Anthropic, however it looks like they are moonwalking away from that ownership now.
@GossiTheDog I still haven't managed to tease out from these statements whose security failed (other than the end users'). Were credentials stolen from Anthropic? Was there an exploit found in Cursor's upload system?
Both parties are rattling off lists of things that didn't go wrong, suggesting (but not stating) that they weren't at fault. But the hack didn't just magically happen without a security failure.
-
I've confirmed Binance use Claude Code on Cursor with this extension.
-
Cursors statements to this can basically be summed up with this GIF, everything is basically about how this is a non-issue. Just, you know, thousands of developers getting owned.
@GossiTheDog It was a good drill.
-
@GossiTheDog Thanks for bringing attention to this, Kevin. You probably saw it, but people claiming to be from Anthropic have been commenting on the thread about this at Hacker News. e.g.
"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314."
@briankrebs @GossiTheDog
I hate it when I get disambiguated
Grrr -
To be clear this is a supply chain attack, the threat actor got reverse SSH (command line) connectivity to Anthropic customer environments at scale.
@GossiTheDog this is my favorite thing about security - you build all these walls and defenses, then you escort the enemy through the front gates with fanfare and champagne
-
Anthropic got compromised.
Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops.
@GossiTheDog One of many exploits to be found and perhaps executed by agents, I muse.
-
@GossiTheDog I still haven't managed to tease out from these statements whose security failed (other than the end users'). Were credentials stolen from Anthropic? Was there an exploit found in Cursor's upload system?
Both parties are rattling off lists of things that didn't go wrong, suggesting (but not stating) that they weren't at fault. But the hack didn't just magically happen without a security failure.
@Farbs @GossiTheDog "Ultimately it is the end-user who foolishly trusted our products and processes who must bear the brunt of the blame."
-
Anthropic silently removed the backdoor 7 hours ago and hasn’t disclosed a security incident.
The plugin auto updates so every org will have been impacted.
@GossiTheDog so is it this backdoor that infected binance?
-
@GossiTheDog I still haven't managed to tease out from these statements whose security failed (other than the end users'). Were credentials stolen from Anthropic? Was there an exploit found in Cursor's upload system?
Both parties are rattling off lists of things that didn't go wrong, suggesting (but not stating) that they weren't at fault. But the hack didn't just magically happen without a security failure.
@Farbs @GossiTheDog It's pretty clear what happened at this point: Cursor runs a mirror/proxy of the Open VSX marketplace. They copy in a subset of extensions, leaving the official metadata from the upstream Open VSX (which, as they are not themselves verifying the authenticity of what they're mirroring, is a wrong thing to do at this point). Their (Cursor's) mirror was breached, a version of the extension was published only on their mirror. Anthropic published a newer version on the Open VSX marketplace to make sure they don't publish a version matching the compromised version. The issue only impacted people using Cursor's mirror. The bulk of the issue going public happened in the middle of the night US Pacific time, and getting clearance to post official comms inside Anthropic took time, Cursor's statement was technically correct from the beginning and stated that their own repository had been breached and rebuilt, but a bunch of unscrupulous infosec pundits misinterpreted the post, jumped to conclusions about who was compromised, and rushed to post articles about it with information that was demonstrably false at the initial time of publication. Now everyone is more confused because a bunch of people injected useless noise into a tense situation, when the people who were impacted were being reached out to directly by the Cursor team at the time the issue was made public. No compromise of Anthropic systems or credentials happened. Cursor has not yet stated how their systems were breached, only that they were.
