@Farbs @GossiTheDog It's pretty clear what happened at this point: Cursor runs a mirror/proxy of the Open VSX marketplace. They copy in a subset of extensions, leaving the official metadata from the upstream Open VSX (which, as they are not themselves verifying the authenticity of what they're mirroring, is a wrong thing to do at this point). Their (Cursor's) mirror was breached, a version of the extension was published only on their mirror. Anthropic published a newer version on the Open VSX marketplace to make sure they don't publish a version matching the compromised version. The issue only impacted people using Cursor's mirror. The bulk of the issue going public happened in the middle of the night US Pacific time, and getting clearance to post official comms inside Anthropic took time, Cursor's statement was technically correct from the beginning and stated that their own repository had been breached and rebuilt, but a bunch of unscrupulous infosec pundits misinterpreted the post, jumped to conclusions about who was compromised, and rushed to post articles about it with information that was demonstrably false at the initial time of publication. Now everyone is more confused because a bunch of people injected useless noise into a tense situation, when the people who were impacted were being reached out to directly by the Cursor team at the time the issue was made public. No compromise of Anthropic systems or credentials happened. Cursor has not yet stated how their systems were breached, only that they were.