Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
That's nonsense. If what felixrieseberg said is true this is very clearly a compromise of Cursor and not Anthropic. Trying to spin it as a compromise of Anthropic is absurd.
+1.
HN has a dedicated upvote functionality.
I think he's saying (erroneously) Anthropic owns Cursor. Reading this claude.com page [1] hawking Cursor you could be forgiven for forming that impression.
[1]: https://claude.com/marketplace/agents-products/cursor
I don't think they're trying to spin this as Anthropic being compromised, but I do think they're correct in saying this is Anthropic's problem to deal with now, regardless of the fact that they're not responsible for the root cause.
That is not what was written; what was described was anthropic losing control over their cursor account - perhaps a key compromise, developer laptop compromise, or a fault in cursor, but of the three, the language suggests the first two.
If you decided to use an umbrella to protect something during a hurricane and umbrella breaks and your thing is ruined. Whose fault is that?
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).
Are you claiming that the Cursor extension store - marketplace.cursorapi.com - does not add their own proxy to Open VSX?
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.
That is simply not how software works.
The situation is confusing, so can I please confirm the following:
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases:
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
[0] https://cursor.com/help/customization/extensions
It wasn't on OpenVSX according to https://news.ycombinator.com/item?id=50305148
Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
I am curious to see how difficult it will be to get this message across on Twitter. $44B seems like a bargain at this point.
This is not directed at you personally but Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
You're confused. It's not Anthropic's responsibility to monitor and fix everything that's said correctly or incorrectly about them. They're doing excellent given what they're capable to do in this situation.
there is NO LEGIT v2.1.313
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148
My guess is someone published an extension on vscode/cursor claiming to be Anthropic when it wasn't. Kind of like me publishing an app called Youtube on the app store, being accepted by Apple and having people download my malicious app called Youtube.
There's been too much guessing already. Anthropic employees answered in this thread almost 4h before your response.
Ok, so... Summing this up
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
Apparently it is public: https://cursor.com/help/customization/extensions
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"
Which is exactly the opposite of what happened today.
Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.
If this isn't a damning indictment of Cursor, I don't know what is. Perhaps it will be the death knell.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
I believe the value add was $60bn in just 4 years https://www.linkedin.com/posts/sytaylor_wild-cursor-just-sol...
I dont know a single person who uses this tool (but im sure there are some) our annual subs recently ran out, I hadnt used mine in 6 months, we did not renew.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
Cursor made Grok Bot and is working on the Grok models.
I wouldn't say it's obviously unsuccessful.
The team behind Cursor and their data were worth $60 billion to Musk, not the app itself.
Considering that the biggest and most successful play for SpaceXAI in the AI space has been "Sell compute to Anthropic" I also wouldn't say that all of the grok junk has been obviously successful, either.
>Perhaps it will be the death knell
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.
Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.
I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.
> I'm still surprised people use CrowdStrike
I mean, LastPass is still in business...
> > I'm still surprised people use CrowdStrike
> I mean, LastPass is still in business...
I mean, Microsoft is still experiencing massive growth.
If Microsoft was any good the entire IT industry would collapse. Millions of high paying careers are built on decades of fixing the garbage that comes out of Redmond. Probably a trillion dollars worth of businesses selling software and support to companies running Microsoft would evaporate as soon as Microsoft doesn’t continue their current efforts.
If I had to guess it's that very few people use it for actual security guarantees and most use it just to be able to fill out the questionnaire or compliance box saying "we do this".
I remember when Crowdstrike was all about mobilizing your spare computer to DDOS the bad guys.
I had to fill a security questionnaire today. One of the questions was
"Do you use crowdstrike falcon?"
What do you suggest instead ?
Their Linux stuff has gotten much better but besides the (insanely huge) recent windows debacle I've found them to be a great product
> They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently)
Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.
> the service ran as root, it UPDATED ITS OWN BINARIES as root!
Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
Crowdstrike and Solarwinds are still being used by nearly every fed govt agency today. It's amazing really that despite everything they still get to suck up our funds.
I forgot entirely about superfish. That takes me back.
My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.
I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.
Seeing as SpaceX owns Curser, I’m surprised there wasn’t a hack on SpaceX… Yet
Who says there wasn't?
A lot of the most valuable SpaceX IP (at least to the big "advanced persistent threat" hackers) is probably related to military secrets, information to let you spy on/disable/control star shield/link, and so on. Not things we'd find out about as the general public.
I mean, who says it wasn't an inside job...
https://www.cnbc.com/2026/10/30/binance-hack-elon-musk-tesla...
I realized this earlier this year and dumped Cursor for just vscode along with 20x subs to Claude and OpenAI. Much cheaper and nothing of value was lost.
Cursor was the first AI coding tool I used that had a "wow" factor and got me to switch over from typing out most of my code to having AI write most of it. But then when I used Claude Code for the first time, I never went back to Cursor.
I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.
I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?
Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.
Is the extension not Anthropic.claude-code developed by Anthropic? Been a while since I used Cursor.
> Cursor routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX.
https://cursor.com/help/customization/extensions
The extensions does not need full access to the laptop.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
Probably a good idea to only run LLMs with a dedicated user account, or in a container.
Dedicated user account does not work as eventually all your code and data will move under that.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.
That looks really nice, including the VSCode/Mac wrapper.
I’m fine with that. I use a top-level directory for all of my code, and restricting extension access to that directory is a great idea.
If all the code and data eventually move into the dedicated user account, why wouldn't it also eventually move into the container/vm?
For locally installed Code / Code-fork extensions, there is not any concept of permissions (at least on Windows or MacOS (+ the 3rd party code-server running on Linux)), correct?
It shouldn't.
Be as close as AGI we are (/s), this issue from 2018 is still open:
https://github.com/microsoft/vscode/issues/52116
I don't know what we are doing.
Does it? It asks for permission to use whatever directory you call it in.
All these security issues have made me want to build more of my own slimmed down tools. It would be great if there were better ways to use claude code with my own minimal harness and still have access to the pro plan.
I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.
>I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.
why do people cry if you say "only"?
I think the concern is that it could be seen as minimizing the harm done to those affected, but I personally think this is kind of a hypersensitive overcorrection :P
Why was version 2.1.313 silently deleted from OpenVSX, Visual Studio Marketplace and Cursor then?
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.
Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.
313 was never released lol https://github.com/anthropics/claude-code/releases
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
Why was the npm version 2.1.313 yanked?
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
Thank you for the clarification and my apologies for misspeaking, as the version indeed does not appear to have been yanked but entirely absent.
smooth sloperators, smooooooooth sloperattorrrrrssss
> The versions on our official channels are not affected and this only impacts Cursor users.
Is Cursor not an official channel for Claude?
> We’re working with Cursor on this incident
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.