[1] https://news.ycombinator.com/item?id=50304129","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:37:55.000Z","created_at_i":1793371075,"id":50304575,"options":[],"parent_id":50302445,"points":null,"story_id":50300683,"text":"> please only use official builds
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:19:34.000Z","created_at_i":1793359174,"id":50302445,"options":[],"parent_id":50302141,"points":null,"story_id":50300683,"text":"1shooner posted this link: https://www.binance.com/en/square/post/10-30-2026-claude-cod... this was not the official extension. Supply Chain is very important, please only use official builds. \nFrom the link above:
A malicious version of Anthropic\u2019s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft\u2019s VS Code Marketplace as a precaution.","title":null,"type":"comment","url":null},{"author":"hoppp","children":[],"created_at":"2026-10-30T13:00:36.000Z","created_at_i":1793365236,"id":50303262,"options":[],"parent_id":50302141,"points":null,"story_id":50301983,"text":"Better be safe and check your dev environment if you use it.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T10:41:28.000Z","created_at_i":1793356888,"id":50302141,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"How legit is this? Seems low on details.
I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?","title":null,"type":"comment","url":null},{"author":"mindracer","children":[{"author":"paxy","children":[],"created_at":"2026-10-30T15:15:05.000Z","created_at_i":1793373305,"id":50305099,"options":[],"parent_id":50302166,"points":null,"story_id":50300683,"text":"The first two words in that URL are wrong, so I'm going to say this doesn't have "more details".","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T10:44:28.000Z","created_at_i":1793357068,"id":50302166,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Some more details
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...","title":null,"type":"comment","url":null},{"author":"1shooner","children":[],"created_at":"2026-10-30T10:52:42.000Z","created_at_i":1793357562,"id":50302231,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Cursor reporting this: \nhttps://cursor.com/blog/claude-code-extension-security-notic...
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...","title":null,"type":"comment","url":null},{"author":"airhangerf15","children":[{"author":"bhubert","children":[{"author":"chrisweekly","children":[],"created_at":"2026-10-30T14:10:09.000Z","created_at_i":1793369409,"id":50304146,"options":[],"parent_id":50303845,"points":null,"story_id":50300683,"text":"Try smolvm microvms from https://smol-machines.com","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:48:46.000Z","created_at_i":1793368126,"id":50303845,"options":[],"parent_id":50302307,"points":null,"story_id":50300683,"text":"You could also start whichever container it needs (the docker work) yourself and just have the two containers container with eachother (e.g. docker compose, without granting access to docker socket), provided that the docker work is static enough that this would work.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:03:29.000Z","created_at_i":1793358209,"id":50302307,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.","title":null,"type":"comment","url":null},{"author":"rolosa","children":[{"author":"episodeiv","children":[{"author":"rolosa","children":[{"author":"fn-mote","children":[{"author":"rolosa","children":[],"created_at":"2026-10-30T18:55:49.000Z","created_at_i":1793386549,"id":50308553,"options":[],"parent_id":50302643,"points":null,"story_id":50300683,"text":"Why should I go out of my way to figure out how to read his twitter?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:44:54.000Z","created_at_i":1793360694,"id":50302643,"options":[],"parent_id":50302480,"points":null,"story_id":50300683,"text":"If you don\u2019t have anything to steal, you don\u2019t need to follow a security researcher anyway.
/s","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:24:25.000Z","created_at_i":1793359465,"id":50302480,"options":[],"parent_id":50302448,"points":null,"story_id":50300683,"text":"Eh, he's already lost me the moment he made it difficult.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:20:02.000Z","created_at_i":1793359202,"id":50302448,"options":[],"parent_id":50302424,"points":null,"story_id":50301983,"text":"You can see his posts at https://cyberplace.social/@GossiTheDog/","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:17:51.000Z","created_at_i":1793359071,"id":50302424,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"He says to follow his social, and he provides his handle, but there's no link, and I have no idea how to read it.","title":null,"type":"comment","url":null},{"author":"henearkr","children":[{"author":"darkwi11ow","children":[{"author":"tyingq","children":[{"author":"axus","children":[{"author":"tyingq","children":[],"created_at":"2026-10-30T19:33:38.000Z","created_at_i":1793388818,"id":50309070,"options":[],"parent_id":50304693,"points":null,"story_id":50300683,"text":"OpenVSX does have an option to use OIDC instead of a long lived token for publishing. I get the feeling a lot of people use the forever-good-unless-revoked token though.
https://github.com/eclipse-openvsx/openvsx/wiki/Trusted-Publ...
Edit: Ah, guess it was not open-vsx, but a in-house Cursor marketplace. https://news.ycombinator.com/item?id=50304129","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:44:36.000Z","created_at_i":1793371476,"id":50304693,"options":[],"parent_id":50302595,"points":null,"story_id":50300683,"text":"Now I'm glad I've not opened VSCodium in a few weeks; I prefer using Claude as a separate application anyways, will have to remove the extensions. \nNo evidence, but I do feel like the problem is going to be OpenVSX and not Anthropic.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:38:50.000Z","created_at_i":1793360330,"id":50302595,"options":[],"parent_id":50302513,"points":null,"story_id":50300683,"text":"Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.","title":null,"type":"comment","url":null},{"author":"AdrianCX","children":[{"author":"darkwi11ow","children":[{"author":"AdrianCX","children":[{"author":"darkwi11ow","children":[{"author":"AdrianCX","children":[{"author":"darkwi11ow","children":[{"author":"darkwi11ow","children":[],"created_at":"2026-10-30T18:10:55.000Z","created_at_i":1793383855,"id":50307913,"options":[],"parent_id":50303416,"points":null,"story_id":50300683,"text":"To anyone who might be reading this exchange, actually\nthere is recently added builtin setting\nfor delayed auto-update, `extensions.autoUpdateDelay`, see https://github.com/microsoft/vscode/issues/316867\nand https://github.com/microsoft/vscode/pull/321039","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:13:25.000Z","created_at_i":1793366005,"id":50303416,"options":[],"parent_id":50303251,"points":null,"story_id":50300683,"text":"Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use Claude, Codex and Cursor/SpaceX agents, and Cursor comes very convenient to have all three in a single interface. Also I still code manually especially when prototyping, so having an IDE helps with it as well. I knew about OpenVSX situation with the search, so when installing extensions I always did triple-checking to verify the extension being really submitted by upstream and not by squatter; but now given upgrades can also deliver a compromise I am thinking of developing an extension that will act in similar manner to pnpm minimum release age.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:59:41.000Z","created_at_i":1793365181,"id":50303251,"options":[],"parent_id":50303090,"points":null,"story_id":50301983,"text":"Why not use claude code directly?
Why risk getting compromised like that?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:40:15.000Z","created_at_i":1793364015,"id":50303090,"options":[],"parent_id":50302987,"points":null,"story_id":50300683,"text":"There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no\ngood alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:28:05.000Z","created_at_i":1793363285,"id":50302987,"options":[],"parent_id":50302943,"points":null,"story_id":50300683,"text":"Then why even allow employees to use that?
Binance got a pretty expensive lesson if that was the cause for their recent hack","title":null,"type":"comment","url":null},{"author":"tyingq","children":[],"created_at":"2026-10-30T13:49:38.000Z","created_at_i":1793368178,"id":50303855,"options":[],"parent_id":50302943,"points":null,"story_id":50300683,"text":"Vscode(ium) extensions are also pretty weak security wise in general. There's little guardrails on what an extension can do.
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:22:37.000Z","created_at_i":1793362957,"id":50302943,"options":[],"parent_id":50302919,"points":null,"story_id":50300683,"text":"Yeah OpenVSX security is a joke, they also have dumb search algorithm which\nallows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim\ntheir proprietary VSCode marketplace to be more secure.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:19:22.000Z","created_at_i":1793362762,"id":50302919,"options":[],"parent_id":50302513,"points":null,"story_id":50300683,"text":"Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...
This could have been avoided by having extensions signed by company doing them with keys and review","title":null,"type":"comment","url":null},{"author":"Lazare","children":[],"created_at":"2026-10-30T13:30:49.000Z","created_at_i":1793367049,"id":50303620,"options":[],"parent_id":50302513,"points":null,"story_id":50300683,"text":"Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)
Edit: It seems Cursor is claiming the tampered files were only in their mirror.","title":null,"type":"comment","url":null},{"author":"albert_e","children":[{"author":"darkwi11ow","children":[],"created_at":"2026-10-30T13:58:35.000Z","created_at_i":1793368715,"id":50303981,"options":[],"parent_id":50303795,"points":null,"story_id":50300683,"text":"Boris: "By winter 2025, 100 percent of my code was written by Claude Code. Not a single line by hand."
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:44:04.000Z","created_at_i":1793367844,"id":50303795,"options":[],"parent_id":50302513,"points":null,"story_id":50300683,"text":"The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s
Vibecoders are safu","title":null,"type":"comment","url":null},{"author":"philipwhiuk","children":[],"created_at":"2026-10-30T16:24:08.000Z","created_at_i":1793377448,"id":50306193,"options":[],"parent_id":50302513,"points":null,"story_id":50300683,"text":"You're ignoring the "or" which is doing a lot of work.
Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"","title":null,"type":"comment","url":null},{"author":"cautiouscat","children":[],"created_at":"2026-10-30T16:27:13.000Z","created_at_i":1793377633,"id":50306246,"options":[],"parent_id":50302513,"points":null,"story_id":50300683,"text":"A lot of this is turning into \u201cwell other company said\u201d but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I\u2019m confused.
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
1: https://news.ycombinator.com/item?id=50304585","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:27:30.000Z","created_at_i":1793359650,"id":50302513,"options":[],"parent_id":50302425,"points":null,"story_id":50300683,"text":"Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize\n(official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX\naccount with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn\u2019t drop/bump that same version on unaffected channels too?","title":null,"type":"comment","url":null},{"author":"mirashii","children":[{"author":"sunaookami","children":[{"author":"mirashii","children":[{"author":"sunaookami","children":[],"created_at":"2026-10-30T13:35:23.000Z","created_at_i":1793367323,"id":50303672,"options":[],"parent_id":50303634,"points":null,"story_id":50301983,"text":"No worries, it's very unexpected. I just remembered because I did the same thing last week and was surprised it worked.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:32:26.000Z","created_at_i":1793367146,"id":50303634,"options":[],"parent_id":50303615,"points":null,"story_id":50301983,"text":"You\u2019re right, I read too quickly.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:30:29.000Z","created_at_i":1793367029,"id":50303615,"options":[],"parent_id":50303483,"points":null,"story_id":50300683,"text":">Also, all their tags are immutable, and so can't just be deleted to hide things
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:20:00.000Z","created_at_i":1793366400,"id":50303483,"options":[],"parent_id":50302650,"points":null,"story_id":50300683,"text":"There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:45:50.000Z","created_at_i":1793360750,"id":50302650,"options":[],"parent_id":50302425,"points":null,"story_id":50300683,"text":"Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....","title":null,"type":"comment","url":null},{"author":"XCSme","children":[],"created_at":"2026-10-30T14:37:12.000Z","created_at_i":1793371032,"id":50304564,"options":[],"parent_id":50302425,"points":null,"story_id":50300683,"text":"I am starting to have a hard time who is responsible for what. I no longer know what's the relationship between companies/products like Anthropic, Cursor, SpaceXAI, Copilot, etc.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:17:55.000Z","created_at_i":1793359075,"id":50302425,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"It wasn't Anthropic that was hacked but SpaceXAI (their Cursor Marketplace).","title":null,"type":"comment","url":null},{"author":"hem777","children":[{"author":"fn-mote","children":[],"created_at":"2026-10-30T11:34:49.000Z","created_at_i":1793360089,"id":50302573,"options":[],"parent_id":50302493,"points":null,"story_id":50302334,"text":"^^ Had to verify that this was a real quote from the chain and not a joke. It is accurate.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:25:37.000Z","created_at_i":1793359537,"id":50302493,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"\u201dI've confirmed Binance use Claude Code with this extension.\u201d","title":null,"type":"comment","url":null},{"author":"xx_ns","children":[{"author":"thevinter","children":[{"author":"Hackbraten","children":[{"author":"Lazare","children":[],"created_at":"2026-10-30T13:36:21.000Z","created_at_i":1793367381,"id":50303688,"options":[],"parent_id":50303071,"points":null,"story_id":50300683,"text":"Cursor maintains a mirror of OpenVSX... Kinda. Except they inject some of their own extensions in it. But it's mostly a mirror.
Edit: Cursor is apparently stating now that the tampered files were only on their mirror not OpenVSX.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:38:09.000Z","created_at_i":1793363889,"id":50303071,"options":[],"parent_id":50302582,"points":null,"story_id":50300683,"text":"Three different marketplaces have been mentioned in this discussion:
1. The Cursor Marketplace (never heard of this one, it\u2019s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)
2. The Visual Studio marketplace, hard-wired into VS Code
3. Open VSX
If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.","title":null,"type":"comment","url":null},{"author":"xx_ns","children":[],"created_at":"2026-10-30T12:38:11.000Z","created_at_i":1793363891,"id":50303072,"options":[],"parent_id":50302582,"points":null,"story_id":50302334,"text":"I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.","title":null,"type":"comment","url":null},{"author":"tveita","children":[],"created_at":"2026-10-30T12:41:18.000Z","created_at_i":1793364078,"id":50303103,"options":[],"parent_id":50302582,"points":null,"story_id":50300683,"text":"But the report OP cites at https://phorion.io/blog/offical-claude-code-vsx-compromise/ doesn't make a claim about Visual Studio Marketplace, only "the official Claude Code for VS Code extension bundle on the Cursor Marketplace"","title":null,"type":"comment","url":null},{"author":"ddworken","children":[],"created_at":"2026-10-30T15:07:16.000Z","created_at_i":1793372836,"id":50304977,"options":[],"parent_id":50302582,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:37:11.000Z","created_at_i":1793360231,"id":50302582,"options":[],"parent_id":50302525,"points":null,"story_id":50300683,"text":"Do you have any sources? OP claims that it *also* affects Open VSX","title":null,"type":"comment","url":null},{"author":"mrweasel","children":[{"author":"eviks","children":[{"author":"mrweasel","children":[{"author":"toyg","children":[{"author":"jeromechoo","children":[{"author":"heartbreak","children":[],"created_at":"2026-10-30T13:58:38.000Z","created_at_i":1793368718,"id":50303982,"options":[],"parent_id":50303381,"points":null,"story_id":50300683,"text":"Hopefully a well-sandboxed claude -p.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:10:55.000Z","created_at_i":1793365855,"id":50303381,"options":[],"parent_id":50303034,"points":null,"story_id":50302334,"text":"The CTA flavor of the year for dev tools is cURLing some arbitrary install script and run it immediately which always sounded ridiculous to me. If instead that script first pipes into claude -p for a basic vulnerability scan before continuing, I would be delighted.","title":null,"type":"comment","url":null},{"author":"jbvlkt","children":[],"created_at":"2026-10-30T13:27:13.000Z","created_at_i":1793366833,"id":50303574,"options":[],"parent_id":50303034,"points":null,"story_id":50300683,"text":"LLM are not designed for that. Unless prompt injection is really solved I would avoid showing LLM untrusted code.","title":null,"type":"comment","url":null},{"author":"no-name-here","children":[{"author":"true_religion","children":[],"created_at":"2026-10-30T21:54:49.000Z","created_at_i":1793397289,"id":50310656,"options":[],"parent_id":50305403,"points":null,"story_id":50300683,"text":"That's a testament to the strength of their so called "commercial quality" security tooling.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:34:30.000Z","created_at_i":1793374470,"id":50305403,"options":[],"parent_id":50303034,"points":null,"story_id":50300683,"text":"Cursor explicitly claims "Before an extension is shown in search or served as a download, Cursor runs automated malware and supply-chain analysis using commercial security tooling. Extensions that fail review are blocked. Cursor also monitors extension-ecosystem threat intelligence and updates its blocklist over time."
However, the bad extension was live for ~11 hours.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:33:28.000Z","created_at_i":1793363608,"id":50303034,"options":[],"parent_id":50302809,"points":null,"story_id":50300683,"text":"> You could download the extension, diff it against the previous version and read all the code.
This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:07:36.000Z","created_at_i":1793362056,"id":50302809,"options":[],"parent_id":50302664,"points":null,"story_id":50300683,"text":"That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.","title":null,"type":"comment","url":null},{"author":"DanielHB","children":[{"author":"mrweasel","children":[{"author":"DanielHB","children":[],"created_at":"2026-10-30T13:50:43.000Z","created_at_i":1793368243,"id":50303876,"options":[],"parent_id":50303424,"points":null,"story_id":50302334,"text":"Most extensions run in vscodium-server, extensions run either as "Local Extensions" that run on the host and "Remote Extensions" that run on the guest. You can clearly see in the UI which ones run where.
I only have a single "Local Extension" and it is open-remote-ssh itself.
Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.
When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:14:29.000Z","created_at_i":1793366069,"id":50303424,"options":[],"parent_id":50303203,"points":null,"story_id":50302334,"text":"Would that really help, if you install the extension it's running in the VSCodium instance on your machine... or is it running in the vscode-server?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:54:51.000Z","created_at_i":1793364891,"id":50303203,"options":[],"parent_id":50302664,"points":null,"story_id":50302334,"text":"I recommend moving to VSCodium and using this extension:
https://github.com/jeanp413/open-remote-ssh
and run vscode-server inside a VM or container","title":null,"type":"comment","url":null},{"author":"dash-44","children":[],"created_at":"2026-10-30T13:41:01.000Z","created_at_i":1793367661,"id":50303759,"options":[],"parent_id":50302664,"points":null,"story_id":50300683,"text":"You disable extension auto updates and then manually install every so often (and only update/install when the version has been out for 3+ days).","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:47:55.000Z","created_at_i":1793360875,"id":50302664,"options":[],"parent_id":50302584,"points":null,"story_id":50300683,"text":"What would be the careful way of installing the official extension?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:37:54.000Z","created_at_i":1793360274,"id":50302584,"options":[],"parent_id":50302525,"points":null,"story_id":50300683,"text":"You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.
This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.","title":null,"type":"comment","url":null},{"author":"misnome","children":[],"created_at":"2026-10-30T11:49:11.000Z","created_at_i":1793360951,"id":50302676,"options":[],"parent_id":50302525,"points":null,"story_id":50300683,"text":"The screenshot is of the official marketplace","title":null,"type":"comment","url":null},{"author":"ddworken","children":[{"author":"xx_ns","children":[],"created_at":"2026-10-30T16:35:02.000Z","created_at_i":1793378102,"id":50306364,"options":[],"parent_id":50305012,"points":null,"story_id":50300683,"text":"Thanks for clarifying!","title":null,"type":"comment","url":null},{"author":"arm32","children":[],"created_at":"2026-10-30T20:47:20.000Z","created_at_i":1793393240,"id":50309931,"options":[],"parent_id":50305012,"points":null,"story_id":50300683,"text":"Hi Dworken from Anthropic, how is that possible if Cursor uses OpenVSX?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:09:49.000Z","created_at_i":1793372989,"id":50305012,"options":[],"parent_id":50302525,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:29:17.000Z","created_at_i":1793359757,"id":50302525,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
[1]: https://code.visualstudio.com/api/working-with-extensions/pu...","title":null,"type":"comment","url":null},{"author":"nubinetwork","children":[{"author":"fn-mote","children":[],"created_at":"2026-10-30T11:35:53.000Z","created_at_i":1793360153,"id":50302576,"options":[],"parent_id":50302572,"points":null,"story_id":50302334,"text":"Emphasis on guessing. If/when there is an actual postmortem, you\u2019ll know when the back door was introduced.","title":null,"type":"comment","url":null},{"author":"fg137","children":[],"created_at":"2026-10-30T11:44:33.000Z","created_at_i":1793360673,"id":50302639,"options":[],"parent_id":50302572,"points":null,"story_id":50302334,"text":"You are either lucky or compromised.","title":null,"type":"comment","url":null},{"author":"koolba","children":[],"created_at":"2026-10-30T11:49:35.000Z","created_at_i":1793360975,"id":50302679,"options":[],"parent_id":50302572,"points":null,"story_id":50302334,"text":"Not updating air gapped systems is a security feature, not a bug.","title":null,"type":"comment","url":null},{"author":"staminade","children":[{"author":"entrope","children":[],"created_at":"2026-10-30T12:12:03.000Z","created_at_i":1793362323,"id":50302848,"options":[],"parent_id":50302756,"points":null,"story_id":50302334,"text":"Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.
I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:01:03.000Z","created_at_i":1793361663,"id":50302756,"options":[],"parent_id":50302572,"points":null,"story_id":50302334,"text":"I think VS Code extensions autoupdate by default, unless you disable it.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:34:47.000Z","created_at_i":1793360087,"id":50302572,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"It looks like they push an update every office day. I'm guessing if I installed 6 months ago and didn't update, that I should be fine?","title":null,"type":"comment","url":null},{"author":"eviks","children":[{"author":"kamban","children":[{"author":"iugtmkbdfil834","children":[{"author":"skydhash","children":[{"author":"mirekrusin","children":[{"author":"jimbokun","children":[],"created_at":"2026-10-30T14:17:42.000Z","created_at_i":1793369862,"id":50304267,"options":[],"parent_id":50303148,"points":null,"story_id":50302334,"text":"Yes, bug count is roughly linear in the number of lines of code.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:47:05.000Z","created_at_i":1793364425,"id":50303148,"options":[],"parent_id":50302845,"points":null,"story_id":50302334,"text":"To be fair it\u2019s not like screwups were not happening before, but if you move 100x faster and are 50x more secure than before you\u2019re still 2x more exposed.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:11:33.000Z","created_at_i":1793362293,"id":50302845,"options":[],"parent_id":50302775,"points":null,"story_id":50300683,"text":"It always about \u201cwe solved the bottleneck in coding\u201d. But the slowness was not about typing, or finding docs. It\u2019s always about ensuring screwups don\u2019t happen.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:03:16.000Z","created_at_i":1793361796,"id":50302775,"options":[],"parent_id":50302704,"points":null,"story_id":50302334,"text":":D I have to assume parent is being a little sarcastic.
It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:52:57.000Z","created_at_i":1793361177,"id":50302704,"options":[],"parent_id":50302649,"points":null,"story_id":50300683,"text":"Yet, they managed to screw up.","title":null,"type":"comment","url":null},{"author":"atrokhymchuk","children":[{"author":"btown","children":[],"created_at":"2026-10-30T12:25:04.000Z","created_at_i":1793363104,"id":50302960,"options":[],"parent_id":50302899,"points":null,"story_id":50300683,"text":"Only with two fully maxed subscriptions can we achieve this, and this is forbiddeneded","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:17:05.000Z","created_at_i":1793362625,"id":50302899,"options":[],"parent_id":50302649,"points":null,"story_id":50302334,"text":"I am afraid until 200x is achieved we are at risk...","title":null,"type":"comment","url":null},{"author":"samiv","children":[],"created_at":"2026-10-30T12:28:07.000Z","created_at_i":1793363287,"id":50302988,"options":[],"parent_id":50302649,"points":null,"story_id":50302334,"text":"Just put gastown on it!","title":null,"type":"comment","url":null},{"author":"stymaar","children":[{"author":"malfist","children":[{"author":"prologic","children":[{"author":"stymaar","children":[{"author":"malfist","children":[],"created_at":"2026-10-30T16:11:19.000Z","created_at_i":1793376679,"id":50305989,"options":[],"parent_id":50303598,"points":null,"story_id":50300683,"text":"Maybe is a security measure, can't hack something if it's never available","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:29:07.000Z","created_at_i":1793366947,"id":50303598,"options":[],"parent_id":50303479,"points":null,"story_id":50300683,"text":"Github's uptime getting stray bullets, I see.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:19:37.000Z","created_at_i":1793366377,"id":50303479,"options":[],"parent_id":50303022,"points":null,"story_id":50302334,"text":"Hey! It's at least 1 9's right? That's better than zero 9's LOL","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:31:40.000Z","created_at_i":1793363500,"id":50303022,"options":[],"parent_id":50303008,"points":null,"story_id":50300683,"text":"I'm glad no one can steal from my bank, they stop 98% of thieves","title":null,"type":"comment","url":null},{"author":"tiahura","children":[{"author":"bix6","children":[],"created_at":"2026-10-30T13:40:15.000Z","created_at_i":1793367615,"id":50303750,"options":[],"parent_id":50303487,"points":null,"story_id":50302334,"text":"https://genai.owasp.org/2026/07/08/genai-and-agentic-ai-expl...","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:20:06.000Z","created_at_i":1793366406,"id":50303487,"options":[],"parent_id":50303008,"points":null,"story_id":50300683,"text":"Can you link to a list of this year\u2019s top prompt injection hacks of frontier models?
Or, is this FUD?","title":null,"type":"comment","url":null},{"author":"lynndotpy","children":[],"created_at":"2026-10-30T13:38:03.000Z","created_at_i":1793367483,"id":50303722,"options":[],"parent_id":50303008,"points":null,"story_id":50302334,"text":"I'm not asking this in rhetoric; do you happen to have a link to this comment? I ask because a comment like that would be something of an insane thing for someone to say.","title":null,"type":"comment","url":null},{"author":"skinfaxi","children":[{"author":"gr_norm","children":[],"created_at":"2026-10-30T14:15:33.000Z","created_at_i":1793369733,"id":50304232,"options":[],"parent_id":50303735,"points":null,"story_id":50300683,"text":"A 30 second search turned up this [1] from two days ago.
Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front.
[1] https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55...
[2] https://x.com/bcherny/status/2086520950259118464
[3] https://embracethered.com/blog/posts/2026/breaking-claude-co...","title":null,"type":"comment","url":null},{"author":"vdfs","children":[],"created_at":"2026-10-30T15:24:58.000Z","created_at_i":1793373898,"id":50305237,"options":[],"parent_id":50303735,"points":null,"story_id":50300683,"text":"https://xkcd.com/1161/","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:39:21.000Z","created_at_i":1793367561,"id":50303735,"options":[],"parent_id":50303008,"points":null,"story_id":50300683,"text":"Simonw said the same thing yesterday:
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
> The open challenge is how to prove it!
https://news.ycombinator.com/item?id=50297369","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:30:18.000Z","created_at_i":1793363418,"id":50303008,"options":[],"parent_id":50302649,"points":null,"story_id":50300683,"text":"I read a few month ago a comment from an Anthropic or OpenAI employee saying that the security problem of prompt injection was a solved problem at this point, as the frontier models where rejecting 98% of attacks.
It tells you all you need to know about how unserious these people are about computer security.","title":null,"type":"comment","url":null},{"author":"Cthulhu_","children":[{"author":"bayindirh","children":[{"author":"alansaber","children":[],"created_at":"2026-10-30T13:54:47.000Z","created_at_i":1793368487,"id":50303939,"options":[],"parent_id":50303760,"points":null,"story_id":50300683,"text":"Shaka, when the context compacted","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:41:06.000Z","created_at_i":1793367666,"id":50303760,"options":[],"parent_id":50303258,"points":null,"story_id":50300683,"text":"It's just a conscious being confined in a cluster of GPUs. How dangerous can it be, eh?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:00:22.000Z","created_at_i":1793365222,"id":50303258,"options":[],"parent_id":50302649,"points":null,"story_id":50300683,"text":"On the other hand, they don't know what their models do or can do and nothing is safe ever, so ???","title":null,"type":"comment","url":null},{"author":"thatsabadlook","children":[],"created_at":"2026-10-30T13:06:10.000Z","created_at_i":1793365570,"id":50303330,"options":[],"parent_id":50302649,"points":null,"story_id":50300683,"text":"[flagged]","title":null,"type":"comment","url":null},{"author":"dgellow","children":[{"author":"IndeanCondor","children":[],"created_at":"2026-10-30T13:22:11.000Z","created_at_i":1793366531,"id":50303518,"options":[],"parent_id":50303477,"points":null,"story_id":50302334,"text":"It's not like there haven't been 20 high visibility VS code extension malware attacks in the last year.
How could Anthropic have known, they only claim to harbour superintelligence.
/s","title":null,"type":"comment","url":null},{"author":"b112","children":[{"author":"phoghed","children":[{"author":"OoooooooO","children":[],"created_at":"2026-10-30T14:03:58.000Z","created_at_i":1793369038,"id":50304063,"options":[],"parent_id":50303969,"points":null,"story_id":50302334,"text":"The correct comparison would be the food producer and poisoned foods out of the factory are really rare.","title":null,"type":"comment","url":null},{"author":"done_lurking","children":[{"author":"dgellow","children":[{"author":"done_lurking","children":[],"created_at":"2026-10-30T15:32:06.000Z","created_at_i":1793374326,"id":50305357,"options":[],"parent_id":50304784,"points":null,"story_id":50300683,"text":"What word would you prefer I use instead of "excuse"?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:50:30.000Z","created_at_i":1793371830,"id":50304784,"options":[],"parent_id":50304205,"points":null,"story_id":50300683,"text":"You\u2019re projecting, I didn\u2019t excuse anything","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:13:51.000Z","created_at_i":1793369631,"id":50304205,"options":[],"parent_id":50303969,"points":null,"story_id":50300683,"text":"Not gp, but I think the point was that no one would defend those mistakes. The post gp is replying to is someone trying to excuse Anthropic for such a mistake. The expectation is that people should ask for consequences, not make excuses on behalf of the company.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:57:50.000Z","created_at_i":1793368670,"id":50303969,"options":[],"parent_id":50303548,"points":null,"story_id":50300683,"text":"Yes, food poisoning from restaurants happens constantly. There are recalls on physical products constantly. Doctors misdiagnose constantly. What point are you trying to make?","title":null,"type":"comment","url":null},{"author":"dgellow","children":[],"created_at":"2026-10-30T14:54:30.000Z","created_at_i":1793372070,"id":50304817,"options":[],"parent_id":50303548,"points":null,"story_id":50300683,"text":"If you completely change the statement, the meaning is different. What\u2019s your point? No software company obeys by regulatory rules imposed in other industry","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:24:33.000Z","created_at_i":1793366673,"id":50303548,"options":[],"parent_id":50303477,"points":null,"story_id":50300683,"text":"Now replace that statement with a food processing company, and food poisoning, or an aircraft designer and engineers.
It may be the cause, but zero excuse.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:19:29.000Z","created_at_i":1793366369,"id":50303477,"options":[],"parent_id":50302649,"points":null,"story_id":50302334,"text":"I get the snark but to be fair, the company has been growing like crazy. That makes it really hard to keep track of everything happening when you grow your team by 5x over a relatively short period of time","title":null,"type":"comment","url":null},{"author":"Tarean","children":[],"created_at":"2026-10-30T13:31:37.000Z","created_at_i":1793367097,"id":50303628,"options":[],"parent_id":50302649,"points":null,"story_id":50302334,"text":"To me this very much sounds like an attacker got access to anthropic's cursor marketplace account and uploaded a backdoored package.\nThis reverse ssh shell was intentionally written by a malicious actor, not a security vulnerability.
It also sounds like only cursor marketplace is affected, not vscode proper.","title":null,"type":"comment","url":null},{"author":"alansaber","children":[],"created_at":"2026-10-30T13:54:17.000Z","created_at_i":1793368457,"id":50303933,"options":[],"parent_id":50302649,"points":null,"story_id":50302334,"text":"I really don't think the scaling is so trivial.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:45:48.000Z","created_at_i":1793360748,"id":50302649,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"That's literally impossible, with all the access to the frontier software development tools at their disposal they can ship features securely at 100x","title":null,"type":"comment","url":null},{"author":"glimshe","children":[{"author":"_heimdall","children":[{"author":"nannal","children":[{"author":"Geezus_42","children":[],"created_at":"2026-10-30T12:40:34.000Z","created_at_i":1793364034,"id":50303094,"options":[],"parent_id":50303019,"points":null,"story_id":50301983,"text":"I've set up something like that with a small local model in my homelab.","title":null,"type":"comment","url":null},{"author":"Filligree","children":[],"created_at":"2026-10-30T13:09:37.000Z","created_at_i":1793365777,"id":50303370,"options":[],"parent_id":50303019,"points":null,"story_id":50300683,"text":"I\u2019ve set up something like that with Opus. Works well enough, and points out CVEs to fix on the regular.
Running NixOS helps.","title":null,"type":"comment","url":null},{"author":"jmbwell","children":[{"author":"stogot","children":[{"author":"nannal","children":[],"created_at":"2026-10-30T14:20:45.000Z","created_at_i":1793370045,"id":50304324,"options":[],"parent_id":50303644,"points":null,"story_id":50301983,"text":"I've got a whole heap of unfinished side projects that I'm digging through","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:33:01.000Z","created_at_i":1793367181,"id":50303644,"options":[],"parent_id":50303425,"points":null,"story_id":50301983,"text":"This is where I silently found gold. All those old TODO when if I have time in retirement","title":null,"type":"comment","url":null},{"author":"codazoda","children":[],"created_at":"2026-10-30T13:42:07.000Z","created_at_i":1793367727,"id":50303775,"options":[],"parent_id":50303425,"points":null,"story_id":50301983,"text":"I just built a retro OS for ESP32\u2019s so that I can write BASIC programs and plop them on microcontrollers. My first ESP32 was a wrist watch. My second is a distraction free writer.
It\u2019s good fun building for retro-like machines.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:14:36.000Z","created_at_i":1793366076,"id":50303425,"options":[],"parent_id":50303019,"points":null,"story_id":50300683,"text":"I love how LLMs have brought DIY software back. Need an app? Just make it. Like back when you\u2019d write programs in BASIC","title":null,"type":"comment","url":null},{"author":"InsidiousWombat","children":[],"created_at":"2026-10-30T14:19:06.000Z","created_at_i":1793369946,"id":50304289,"options":[],"parent_id":50303019,"points":null,"story_id":50300683,"text":"That's cute but bill for going thru even tens of log lines per second gonna be more expensive than entire rest of the infrastructure.","title":null,"type":"comment","url":null},{"author":"cedws","children":[],"created_at":"2026-10-30T15:34:13.000Z","created_at_i":1793374453,"id":50305397,"options":[],"parent_id":50303019,"points":null,"story_id":50300683,"text":"How does it resolve the prompt injection?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:31:22.000Z","created_at_i":1793363482,"id":50303019,"options":[],"parent_id":50302682,"points":null,"story_id":50300683,"text":"I do have a log reading / action / resolution product in the works.
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.","title":null,"type":"comment","url":null},{"author":"jacquesm","children":[],"created_at":"2026-10-30T14:38:21.000Z","created_at_i":1793371101,"id":50304581,"options":[],"parent_id":50302682,"points":null,"story_id":50300683,"text":"And if you remove it, it installs itself right back. For uninstall instructions see the infamous McAfee video.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:50:06.000Z","created_at_i":1793361006,"id":50302682,"options":[],"parent_id":50302653,"points":null,"story_id":50300683,"text":"Don't worry, I assume an LLM version of McAfee Total Protection Antivirus is coming soon","title":null,"type":"comment","url":null},{"author":"eviks","children":[],"created_at":"2026-10-30T11:50:33.000Z","created_at_i":1793361033,"id":50302687,"options":[],"parent_id":50302653,"points":null,"story_id":50300683,"text":"It was safety-contrained from being able to realize its full potential.","title":null,"type":"comment","url":null},{"author":"MisterTea","children":[{"author":"claytongulick","children":[],"created_at":"2026-10-30T13:30:09.000Z","created_at_i":1793367009,"id":50303612,"options":[],"parent_id":50303055,"points":null,"story_id":50300683,"text":"Damn, thank you for that.
Sums up my feelings of the last few years nicely.","title":null,"type":"comment","url":null},{"author":"vintermann","children":[{"author":"bagacrap","children":[],"created_at":"2026-10-30T14:14:41.000Z","created_at_i":1793369681,"id":50304215,"options":[],"parent_id":50304141,"points":null,"story_id":50300683,"text":"Somehow bullish if anthropic spins this as Claude's own doing","title":null,"type":"comment","url":null},{"author":"ben_w","children":[],"created_at":"2026-10-30T14:31:19.000Z","created_at_i":1793370679,"id":50304466,"options":[],"parent_id":50304141,"points":null,"story_id":50300683,"text":"> (This is a joke, to be clear.)
Good that you said so, this is annoyingly plausible.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:09:44.000Z","created_at_i":1793369384,"id":50304141,"options":[],"parent_id":50303055,"points":null,"story_id":50300683,"text":"Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.
(This is a joke, to be clear.)","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:35:49.000Z","created_at_i":1793363749,"id":50303055,"options":[],"parent_id":50302653,"points":null,"story_id":50300683,"text":"They weren't using last minutes model, which is totally better than last hours model which would have totally detected this, pinkie swear.","title":null,"type":"comment","url":null},{"author":"Hackbraten","children":[],"created_at":"2026-10-30T12:47:32.000Z","created_at_i":1793364452,"id":50303153,"options":[],"parent_id":50302653,"points":null,"story_id":50300683,"text":"You\u2019re absolutely correct, and I owe you a honest statement\u2014it was a hack, and here\u2019s the kicker: *I failed to catch it, and that\u2019s on me.*
Here\u2019s a complete rundown of what happened\u2014load-bearing parts first:","title":null,"type":"comment","url":null},{"author":"viraptor","children":[{"author":"cryptonym","children":[{"author":"viraptor","children":[{"author":"cryptonym","children":[{"author":"viraptor","children":[],"created_at":"2026-10-30T14:34:44.000Z","created_at_i":1793370884,"id":50304510,"options":[],"parent_id":50304332,"points":null,"story_id":50300683,"text":"Yeah, it shouldn't. But at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly. We know it isn't and it's not at that level, because anthropic employs engineers.","title":null,"type":"comment","url":null},{"author":"cryptonym","children":[],"created_at":"2026-10-30T14:40:32.000Z","created_at_i":1793371232,"id":50304630,"options":[],"parent_id":50304332,"points":null,"story_id":50300683,"text":"> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:20:56.000Z","created_at_i":1793370056,"id":50304332,"options":[],"parent_id":50304206,"points":null,"story_id":50300683,"text":"Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.","title":null,"type":"comment","url":null},{"author":"unshavedyak","children":[],"created_at":"2026-10-30T14:34:45.000Z","created_at_i":1793370885,"id":50304511,"options":[],"parent_id":50304206,"points":null,"story_id":50300683,"text":"As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:13:52.000Z","created_at_i":1793369632,"id":50304206,"options":[],"parent_id":50303987,"points":null,"story_id":50301983,"text":"I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:58:52.000Z","created_at_i":1793368732,"id":50303987,"options":[],"parent_id":50303666,"points":null,"story_id":50300683,"text":"> someone got the credentials
> No review system at anthropic has seen this
Weird flex","title":null,"type":"comment","url":null},{"author":"InsidiousWombat","children":[{"author":"paxy","children":[],"created_at":"2026-10-30T14:30:59.000Z","created_at_i":1793370659,"id":50304458,"options":[],"parent_id":50304270,"points":null,"story_id":50300683,"text":"Who is "they"? This is a third party registry.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:17:53.000Z","created_at_i":1793369873,"id":50304270,"options":[],"parent_id":50303666,"points":null,"story_id":50300683,"text":"It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious","title":null,"type":"comment","url":null},{"author":"eviks","children":[{"author":"crooked-v","children":[],"created_at":"2026-10-30T20:39:48.000Z","created_at_i":1793392788,"id":50309841,"options":[],"parent_id":50304275,"points":null,"story_id":50300683,"text":"Because it wasn't published by them or hosted on a system they control, it was done directly on Cursor's mirror of OpenVSX with a modified copy of the original extension.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:18:13.000Z","created_at_i":1793369893,"id":50304275,"options":[],"parent_id":50303666,"points":null,"story_id":50300683,"text":"Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?","title":null,"type":"comment","url":null},{"author":"jacquesm","children":[],"created_at":"2026-10-30T14:36:32.000Z","created_at_i":1793370992,"id":50304552,"options":[],"parent_id":50303666,"points":null,"story_id":50300683,"text":"Intelligence that powerful and for them too cheap to meter and their review system couldn't be bothered.
That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.
At a minimum they should monitor the larger marketplaces even if they're not in the chain.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:34:44.000Z","created_at_i":1793367284,"id":50303666,"options":[],"parent_id":50302653,"points":null,"story_id":50300683,"text":"This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:46:12.000Z","created_at_i":1793360772,"id":50302653,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Why didn't Claude detect the hack and prevent it from affecting customers using its superhuman AGI reasoning?","title":null,"type":"comment","url":null},{"author":"stopsayingsorry","children":[{"author":"stbenjam","children":[{"author":"gcoakes","children":[],"created_at":"2026-10-30T12:12:36.000Z","created_at_i":1793362356,"id":50302853,"options":[],"parent_id":50302680,"points":null,"story_id":50300683,"text":"I think that's just the number Cursor has telemetry on. I think there's multiple distribution locations.","title":null,"type":"comment","url":null},{"author":"misnome","children":[{"author":"paxy","children":[],"created_at":"2026-10-30T15:13:24.000Z","created_at_i":1793373204,"id":50305072,"options":[],"parent_id":50302867,"points":null,"story_id":50300683,"text":"The VSCode store wasn't hacked.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:13:51.000Z","created_at_i":1793362431,"id":50302867,"options":[],"parent_id":50302680,"points":null,"story_id":50300683,"text":"5000 is the cursor number for people on the cursor version of the store, not the VSCode store.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:49:52.000Z","created_at_i":1793360992,"id":50302680,"options":[],"parent_id":50302654,"points":null,"story_id":50300683,"text":"5,000*","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:46:27.000Z","created_at_i":1793360787,"id":50302654,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Imagine backdooring 50+ million installs.
Hats off to the hackers.","title":null,"type":"comment","url":null},{"author":"K0nserv","children":[{"author":"cube00","children":[{"author":"K0nserv","children":[],"created_at":"2026-10-30T12:10:55.000Z","created_at_i":1793362255,"id":50302834,"options":[],"parent_id":50302800,"points":null,"story_id":50300683,"text":"For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.","title":null,"type":"comment","url":null},{"author":"bakies","children":[],"created_at":"2026-10-30T12:40:49.000Z","created_at_i":1793364049,"id":50303100,"options":[],"parent_id":50302800,"points":null,"story_id":50300683,"text":"That's why I stay away from that dumpster fire too!","title":null,"type":"comment","url":null},{"author":"InsidiousWombat","children":[],"created_at":"2026-10-30T14:20:55.000Z","created_at_i":1793370055,"id":50304331,"options":[],"parent_id":50302800,"points":null,"story_id":50301983,"text":"now I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:06:18.000Z","created_at_i":1793361978,"id":50302800,"options":[],"parent_id":50302662,"points":null,"story_id":50300683,"text":"Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.","title":null,"type":"comment","url":null},{"author":"6thbit","children":[],"created_at":"2026-10-30T17:14:53.000Z","created_at_i":1793380493,"id":50306995,"options":[],"parent_id":50302662,"points":null,"story_id":50300683,"text":"I suppose it's just the best ROI on using a complex attack vector or spending one or more zero days. But other types of targets may wreak havoc for bystanders that become collateral damage, idk trying to get specific private info on a target may expose data on millions, or anything increasing scope as to hide the real target, etc.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:47:52.000Z","created_at_i":1793360872,"id":50302662,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.","title":null,"type":"comment","url":null},{"author":"misnome","children":[],"created_at":"2026-10-30T11:54:21.000Z","created_at_i":1793361261,"id":50302717,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Has anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.","title":null,"type":"comment","url":null},{"author":"helsinkiandrew","children":[{"author":"qwrkll","children":[{"author":"literallyroy","children":[],"created_at":"2026-10-30T15:20:16.000Z","created_at_i":1793373616,"id":50305172,"options":[],"parent_id":50304684,"points":null,"story_id":50300683,"text":"No the version was skipped. 2.1.314 was published instead. Issue is with Cursor marketplace nothing else.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:44:19.000Z","created_at_i":1793371459,"id":50304684,"options":[],"parent_id":50302743,"points":null,"story_id":50300683,"text":"As the article says, version 2.1.313 was silently deleted from OpenVSX, Visual Studio Marketplace and Cursor.
There is more going on here. Cursor is covering for Anthropic because of the huge data center contract with SpaceX.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T11:57:35.000Z","created_at_i":1793361455,"id":50302743,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic\u2019s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...","title":null,"type":"comment","url":null},{"author":"anon-3988","children":[{"author":"staminade","children":[{"author":"minraws","children":[],"created_at":"2026-10-30T12:24:02.000Z","created_at_i":1793363042,"id":50302954,"options":[],"parent_id":50302806,"points":null,"story_id":50300683,"text":"Can't their millions of agent swarms detect a malicious supply chain vector, sure it can happen to any company but not the one people are literally handing over their entire companies too.
Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:07:23.000Z","created_at_i":1793362043,"id":50302806,"options":[],"parent_id":50302764,"points":null,"story_id":50300683,"text":"This was a compromise of the extension. The same kind of supply-chain attack could happen to literally any extension, package or other piece of software you install. Not excusing Anthropic letting this happen, but it doesn't have any bearing on the security and privacy of using Claude Code or Codex. Yes, you need to be careful about what they do. The fact that you might still get pwned via some other vector is irrelevant.","title":null,"type":"comment","url":null},{"author":"Den_VR","children":[],"created_at":"2026-10-30T12:08:02.000Z","created_at_i":1793362082,"id":50302815,"options":[],"parent_id":50302764,"points":null,"story_id":50302334,"text":"There\u2019s a reason codex and the like improved like they did. You can simply look. Or hear about it on podcasts.","title":null,"type":"comment","url":null},{"author":"snaking0776","children":[],"created_at":"2026-10-30T12:08:38.000Z","created_at_i":1793362118,"id":50302821,"options":[],"parent_id":50302764,"points":null,"story_id":50302334,"text":"In at least one case they were! https://cybernews.com/ai-news/grok-build-git-repository-uplo...","title":null,"type":"comment","url":null},{"author":"origini","children":[],"created_at":"2026-10-30T12:17:07.000Z","created_at_i":1793362627,"id":50302900,"options":[],"parent_id":50302764,"points":null,"story_id":50300683,"text":"Don't forget: To make LLM useful you give it EVERYTHING it needs to know to be useful and if you don't use a certain provider with proper legal status, this is just gone.
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
Btw. you could setup a sandbox and limit access","title":null,"type":"comment","url":null},{"author":"raxxorraxor","children":[{"author":"deadbabe","children":[],"created_at":"2026-10-30T12:38:57.000Z","created_at_i":1793363937,"id":50303074,"options":[],"parent_id":50303032,"points":null,"story_id":50302334,"text":"No but we use MCP so we\u2019re fine.","title":null,"type":"comment","url":null},{"author":"novafunc","children":[{"author":"wolttam","children":[{"author":"foodevl","children":[],"created_at":"2026-10-30T13:49:36.000Z","created_at_i":1793368176,"id":50303854,"options":[],"parent_id":50303436,"points":null,"story_id":50302334,"text":"Timing. A megabyte of "sleep 10;" would be read from the server more slowly when piped to bash versus written to a file","title":null,"type":"comment","url":null},{"author":"valleyer","children":[],"created_at":"2026-10-30T13:56:47.000Z","created_at_i":1793368607,"id":50303962,"options":[],"parent_id":50303436,"points":null,"story_id":50300683,"text":"Heuristically: https://web.archive.org/web/20250622061208/https://www.idont...","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:15:57.000Z","created_at_i":1793366157,"id":50303436,"options":[],"parent_id":50303165,"points":null,"story_id":50300683,"text":"
curl > some_file\n bash some_file\nEdit: thanks for the replies, that makes perfect sense","title":null,"type":"comment","url":null},{"author":"vladvasiliu","children":[],"created_at":"2026-10-30T13:35:20.000Z","created_at_i":1793367320,"id":50303671,"options":[],"parent_id":50303165,"points":null,"story_id":50300683,"text":"I think the difference people were warned about is that the server can infer the client, so there would be a difference between reading it in your regular browser and curling. As the other commenter says, I'm not sure how the server would be able to tell what curl does with the response.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:48:54.000Z","created_at_i":1793364534,"id":50303165,"options":[],"parent_id":50303032,"points":null,"story_id":50302334,"text":"I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.
So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:33:22.000Z","created_at_i":1793363602,"id":50303032,"options":[],"parent_id":50302764,"points":null,"story_id":50300683,"text":"Both is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.
You always do that, right? ...right?","title":null,"type":"comment","url":null},{"author":"magnio","children":[{"author":"palata","children":[{"author":"knottn","children":[],"created_at":"2026-10-30T13:05:47.000Z","created_at_i":1793365547,"id":50303326,"options":[],"parent_id":50303106,"points":null,"story_id":50302334,"text":"Maybe it\u2019s easier to outsource.","title":null,"type":"comment","url":null},{"author":"jimbokun","children":[{"author":"seanw444","children":[],"created_at":"2026-10-30T20:59:29.000Z","created_at_i":1793393969,"id":50310066,"options":[],"parent_id":50304622,"points":null,"story_id":50300683,"text":"That's what reputations are for.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:40:15.000Z","created_at_i":1793371215,"id":50304622,"options":[],"parent_id":50303106,"points":null,"story_id":50300683,"text":"Because there\u2019s no credentialing thus no fear of losing those hard earned credentials.","title":null,"type":"comment","url":null},{"author":"TheCapn","children":[{"author":"palata","children":[],"created_at":"2026-10-30T16:09:03.000Z","created_at_i":1793376543,"id":50305950,"options":[],"parent_id":50304837,"points":null,"story_id":50300683,"text":"I mostly agree, but I would like to mention that we are destroying our planet also because of the other fields of engineering :-).
Sure, software has a lot more malpractice ("let's ship barely-tested, unfinished stuff"), but let's not say that "the other engineers" are making the world a better place merely by "being real engineers".","title":null,"type":"comment","url":null},{"author":"chasd00","children":[{"author":"palata","children":[],"created_at":"2026-10-30T16:52:35.000Z","created_at_i":1793379155,"id":50306649,"options":[],"parent_id":50306256,"points":null,"story_id":50300683,"text":"Agreed. And let's not forget that those are engineers who develop stuff like electronic cigarettes or... well... bombs.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:27:51.000Z","created_at_i":1793377671,"id":50306256,"options":[],"parent_id":50304837,"points":null,"story_id":50300683,"text":"I wouldn't hold regular engineers in such high regard. I know plenty of EEs, MEs and CEs that don't really give a f** about anything except a paycheck same as software developers.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:56:40.000Z","created_at_i":1793372200,"id":50304837,"options":[],"parent_id":50303106,"points":null,"story_id":50300683,"text":"I'm just going to copy-paste my own comment from a few weeks ago because I feel like it is needing to be said more and more recently
---
I have, off and on, for years written diatribes about how if people in our industry want to run around with the "Engineer" moniker at some point they should start acting like it. That means respecting all aspects of what it means to be an Engineer and holding public well-being paramount is part of that. Licensure is part of that. Accountability and Responsibility is part of that.
I'm usually downvoted. The move fast and break things group seems to be blind (or willfully ignorant) to the harm that software systems can carry on a person's life. I don't know if its fear of regulation, or self-serving interests or some sort of disdain for the idea that we need to slow down and be more accountable to the public or what. At times the people I've engaged with lament on how they're capable but would be barred for lack of formal education or some such and its a distraction from the overall point: we need to be doing better and if we can't self-regulate then at some point we're going to be forced to act in a way that probably cuffs us more than necessary.
And yes, I understand how Software doesn't exactly fit into the mold of other engineering disciplines cleanly. But I think the idea that if we're going to have systems that can ruin a person's life in a second for a bug or oversight we need to start considering that accountability for those releasing software to the public matters. We lament about the difficulty of holding corporations to account for their harm, but it would be far more difficult for a company's negligence to hurt people if those turning the knobs were held to a higher standard.
I think that reckoning is coming soon. AI is going to create "an event" that we can't ignore and we're going to be pointing fingers in a lot of directions asking "how" we could prevent this from happening again. I'd argue "the event" has already occurred a few times over but we're purposely ignoring the severity of it to keep a diseased economy running roughshod. There's parallels with many historic events forcing regulation and the path forward won't be clean and easy.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:41:34.000Z","created_at_i":1793364094,"id":50303106,"options":[],"parent_id":50303057,"points":null,"story_id":50300683,"text":"I think that software engineering is very much engineering.
I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:35:54.000Z","created_at_i":1793363754,"id":50303057,"options":[],"parent_id":50302764,"points":null,"story_id":50300683,"text":"> Who's checking?
Yeah I sympathize with people saying software developers should not be called engineers too.","title":null,"type":"comment","url":null},{"author":"darkwi11ow","children":[{"author":"hangrybear666","children":[],"created_at":"2026-10-30T13:10:53.000Z","created_at_i":1793365853,"id":50303379,"options":[],"parent_id":50303234,"points":null,"story_id":50300683,"text":"Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.","title":null,"type":"comment","url":null},{"author":"rietta","children":[{"author":"darkwi11ow","children":[{"author":"rietta","children":[],"created_at":"2026-10-30T13:39:47.000Z","created_at_i":1793367587,"id":50303743,"options":[],"parent_id":50303638,"points":null,"story_id":50302334,"text":"Yup, I give them a custom entry in ~/.ssh/config like:
```\nhost claudebox\n hostname 192.168.122.105\n user developer\n IdentityFile ~/.ssh/id_rsa\n```
```\nhost codexbox\n hostname 192.168.122.106\n user developer\n IdentityFile ~/.ssh/id_rsa\n```
I drop only my public key inside the VM. Then I set up the ~/Projects folder with the code the bot is working on any any authorized samples.
Then in my local on my host clone of the repository, I add another remote like
```\ngit remote add codexbox ssh://codexbox/home/developer/Projects/hello-world\n```
Then git push codexbox.
Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:32:35.000Z","created_at_i":1793367155,"id":50303638,"options":[],"parent_id":50303557,"points":null,"story_id":50302334,"text":"Wow, great notion about using git remote to transfer source from the agent host. I already use ssh into VM to transfer the files like designs for sharing, so going to adopt your approach right now :)","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:25:19.000Z","created_at_i":1793366719,"id":50303557,"options":[],"parent_id":50303234,"points":null,"story_id":50300683,"text":"I am doing similar with Debian 13 images in QEMU. Only access is to code specifically SSH in. On some, I am taking it a step further and my SSH key is not present at all on the bot. I add it as a git remote from my host into the VM and push and pull from there and then push to GitHub myself. So the agent has no path to GitHub either.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:58:09.000Z","created_at_i":1793365089,"id":50303234,"options":[],"parent_id":50302764,"points":null,"story_id":50300683,"text":"I only use agentic development tools in qemu VM that has no production\naccess or host shared folders, and the only secrets there are development.\nI still have my Git ssh key there, but I never use ssh agent to load the keys.\nThe worst that agentic tools can do to me, is to install keylogger and compromise\nmy ssh key and password, but even then my deployment workflow includes creating release in Github,\nwhich is not possible via ssh key only. I was very lucky to avoid the hack yesterday, as I use Claude installed via OpenVSX, but even if I installed the compromised version, the damage would be minimal.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:01:46.000Z","created_at_i":1793361706,"id":50302764,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?","title":null,"type":"comment","url":null},{"author":"AdrianCX","children":[{"author":"iugtmkbdfil834","children":[],"created_at":"2026-10-30T12:05:33.000Z","created_at_i":1793361933,"id":50302789,"options":[],"parent_id":50302777,"points":null,"story_id":50300683,"text":"Isn't it fun when all the lines are blurred and it is hard to tell what belongs where?","title":null,"type":"comment","url":null},{"author":"darkwi11ow","children":[{"author":"origini","children":[{"author":"stopsayingsorry","children":[{"author":"stingraycharles","children":[{"author":"kirth_gersen","children":[],"created_at":"2026-10-30T13:18:03.000Z","created_at_i":1793366283,"id":50303459,"options":[],"parent_id":50303185,"points":null,"story_id":50300683,"text":"True, but there are other people working at the companies that probably own stock in both their own company and some of the others...if you believe that this is the future, you'd be a fool to buy non-AI tech stocks, right?","title":null,"type":"comment","url":null},{"author":"chrisgarand","children":[{"author":"alpha_squared","children":[{"author":"extraextra","children":[],"created_at":"2026-10-30T14:40:28.000Z","created_at_i":1793371228,"id":50304626,"options":[],"parent_id":50303910,"points":null,"story_id":50300683,"text":"He specifically said that lender money dried up for neocloud companies that don't have other sources of income
SpaceX obviously has multiple sources of income, not just data center rents","title":null,"type":"comment","url":null},{"author":"chrisgarand","children":[],"created_at":"2026-10-30T15:33:10.000Z","created_at_i":1793374390,"id":50305378,"options":[],"parent_id":50303910,"points":null,"story_id":50300683,"text":"They do have their own segment that is considered neocloud (data centers for compute), but they're mostly/fully used up with their own, and Anthropic's compute.
When he was talking about neoclouds, he was talking about the smaller guys who are getting bullied by vendors (mainly Nvidia) to buy as much hardware as possible (more than they want to). They paid more, for more, and needed to take on more debt, to end up (currently anyways) being well below capacity.
Over the next few years, unless growth keeps up (and probably accelerates), they'll need to sell, or restructure.
The buildouts by Microsoft, Google, Meta, OpenAI, and Anthropic are currently safe. The neoclouds that they've signed contracts with, are safe, but based on reports, that's roughly 60% of current capacity (it varies by report, but they're all under 75%).","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:52:57.000Z","created_at_i":1793368377,"id":50303910,"options":[],"parent_id":50303755,"points":null,"story_id":50300683,"text":"Didn't SpaceX partially admit they're a neocloud in their S-1?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:40:46.000Z","created_at_i":1793367646,"id":50303755,"options":[],"parent_id":50303185,"points":null,"story_id":50300683,"text":"Neoclouds aren't Anthropic, OpenAI, and SpaceX. People aren't going to re-value value SpaceX on CoreWeave's success.
SpaceX will be re-valued on Anthropic's, or OpenAI's success, he, and his people are smart enough to understand this.","title":null,"type":"comment","url":null},{"author":"bix6","children":[],"created_at":"2026-10-30T13:41:45.000Z","created_at_i":1793367705,"id":50303769,"options":[],"parent_id":50303185,"points":null,"story_id":50300683,"text":"Somebody doesn\u2019t want anybody to have a bigger IPO than them.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:52:02.000Z","created_at_i":1793364722,"id":50303185,"options":[],"parent_id":50302940,"points":null,"story_id":50300683,"text":"Wasn\u2019t Elon Musk shouting a few days ago that neoclouds are going to crash, the money dried up and that SpaceX was the last company with the opportunity to raise more money?
I think you\u2019re giving Musk too much credit.","title":null,"type":"comment","url":null},{"author":"lkbm","children":[],"created_at":"2026-10-30T14:14:49.000Z","created_at_i":1793369689,"id":50304219,"options":[],"parent_id":50302940,"points":null,"story_id":50300683,"text":"The person at the top refers to Anthropic as "Misanthropic". It seems unlikely that they're also intentionally lying about this to protect Anthropic's interests.
Your conspiracy theory needs some work.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:21:59.000Z","created_at_i":1793362919,"id":50302940,"options":[],"parent_id":50302886,"points":null,"story_id":50300683,"text":"People at the top know that, once the music stops, the ball is over for everyone.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:15:51.000Z","created_at_i":1793362551,"id":50302886,"options":[],"parent_id":50302850,"points":null,"story_id":50300683,"text":"I don't think Spacex cares at all about Anthropics IPO just because they rent out their compute.
Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.","title":null,"type":"comment","url":null},{"author":"AdrianCX","children":[],"created_at":"2026-10-30T12:23:40.000Z","created_at_i":1793363020,"id":50302952,"options":[],"parent_id":50302850,"points":null,"story_id":50300683,"text":"OpenVSX has no extension signing, no verification, nothing...
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed","title":null,"type":"comment","url":null},{"author":"WarmWash","children":[{"author":"jorisw","children":[{"author":"tclancy","children":[],"created_at":"2026-10-30T16:52:29.000Z","created_at_i":1793379149,"id":50306646,"options":[],"parent_id":50304409,"points":null,"story_id":50300683,"text":"It's easy if you have a big ball of red string already.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:26:39.000Z","created_at_i":1793370399,"id":50304409,"options":[],"parent_id":50304348,"points":null,"story_id":50300683,"text":"And pretend to know and understand the ties between big names","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:22:01.000Z","created_at_i":1793370121,"id":50304348,"options":[],"parent_id":50302850,"points":null,"story_id":50300683,"text":"It's annoying how fast people run to conspiracy.","title":null,"type":"comment","url":null},{"author":"no-name-here","children":[],"created_at":"2026-10-30T15:29:37.000Z","created_at_i":1793374177,"id":50305318,"options":[],"parent_id":50302850,"points":null,"story_id":50300683,"text":"> Cursor routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX.
https://cursor.com/help/customization/extensions","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:12:10.000Z","created_at_i":1793362330,"id":50302850,"options":[],"parent_id":50302777,"points":null,"story_id":50300683,"text":"It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor\nlikely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)","title":null,"type":"comment","url":null},{"author":"mrweasel","children":[{"author":"stingraycharles","children":[],"created_at":"2026-10-30T12:54:16.000Z","created_at_i":1793364856,"id":50303199,"options":[],"parent_id":50302878,"points":null,"story_id":50300683,"text":"For what it\u2019s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.
So that\u2019s how these things can go, the employee\u2019s machine may have been infected which was then used to inject this.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:14:47.000Z","created_at_i":1793362487,"id":50302878,"options":[],"parent_id":50302777,"points":null,"story_id":50300683,"text":"Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?","title":null,"type":"comment","url":null},{"author":"cookiengineer","children":[{"author":"solid_fuel","children":[],"created_at":"2026-10-30T18:50:25.000Z","created_at_i":1793386225,"id":50308472,"options":[],"parent_id":50303740,"points":null,"story_id":50300683,"text":"If the docs are vibecoded too that would explain why there's a link to the compromised "not official" cursor version of the extension here https://code.claude.com/docs/en/vs-code which they supposedly aren't responsible for.
It sure seems like they've been vibecoding with everyone asleep at the wheel for a while.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:39:36.000Z","created_at_i":1793367576,"id":50303740,"options":[],"parent_id":50302777,"points":null,"story_id":50300683,"text":"LGTM [1] sing
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody there reads their pushed code anymore. Take a look at the previous Claude Code leaked codebases if you don't believe me, there is hundreds of files with 1000+ or more import statements at the top.
Any human would immediately tell you that it needs to be refactored from scratch. Their codebase also leaked that they're using review bots automatically instead of a human-in-the-loop review process.
[1] https://m.youtube.com/watch?v=3TNpOD6bov8
edit: downvoting me doesn't make it untrue, by the way. Check the leaked codebases, I dare you to provide evidence to the contrary.","title":null,"type":"comment","url":null},{"author":"tekawade","children":[{"author":"no-name-here","children":[{"author":"TazeTSchnitzel","children":[],"created_at":"2026-10-30T17:03:15.000Z","created_at_i":1793379795,"id":50306816,"options":[],"parent_id":50305156,"points":null,"story_id":50300683,"text":"And it is linked to here: https://code.claude.com/docs/en/vs-code (or, well, the URI doesn't tell us if it's using a proxied version or not, so it's complicated)","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:19:12.000Z","created_at_i":1793373552,"id":50305156,"options":[],"parent_id":50303991,"points":null,"story_id":50300683,"text":"> Anthropic only has an official extension for VS Code.
That likely seems incorrect as I see Claude Code listed on open-vsx with:
* An "Anthropic" "Verified publisher" badge
* igorkofman listed who seems to be an Anthropic employee
* 63M downloads
* Reviews going back >1 year
https://open-vsx.org/extension/Anthropic/claude-code","title":null,"type":"comment","url":null},{"author":"mday404","children":[],"created_at":"2026-10-30T16:02:32.000Z","created_at_i":1793376152,"id":50305850,"options":[],"parent_id":50303991,"points":null,"story_id":50300683,"text":"The AI summary here is right and the human info is wrong -- Anthropic does publish the Cursor extension in general, but did not publish this version","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:59:08.000Z","created_at_i":1793368748,"id":50303991,"options":[],"parent_id":50302777,"points":null,"story_id":50300683,"text":"Anthropic only has an official extension for VS Code. Cursor is vs code fork and gave its own marketplace.
IIUC Anthropic does not publish extensions for Cursor. It\u2019s basically, official Claude code extension \u201cclone\u201d not by Anthropic.
Ai summary in better words:\nThe Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.","title":null,"type":"comment","url":null},{"author":"ddworken","children":[{"author":"philipwhiuk","children":[{"author":"john_strinlai","children":[{"author":"abirch","children":[{"author":"crooked-v","children":[],"created_at":"2026-10-30T20:43:39.000Z","created_at_i":1793393019,"id":50309891,"options":[],"parent_id":50306558,"points":null,"story_id":50300683,"text":"Because what they had was some kind of admin access to Cursor's mirror of OpenVSX, and not anything else.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:47:13.000Z","created_at_i":1793378833,"id":50306558,"options":[],"parent_id":50306269,"points":null,"story_id":50300683,"text":"Exactly and why wouldn't the thieves publish to the official VS Code or Open VSX market places?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:29:00.000Z","created_at_i":1793377740,"id":50306269,"options":[],"parent_id":50306165,"points":null,"story_id":50300683,"text":">the corporate laptop
an anthropic laptop? why are you sketpical?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:22:38.000Z","created_at_i":1793377358,"id":50306165,"options":[],"parent_id":50305139,"points":null,"story_id":50300683,"text":"I'm skeptical that the corporate laptop wasn't somehow compromised - or at least the key material leaked.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:17:49.000Z","created_at_i":1793373469,"id":50305139,"options":[],"parent_id":50302777,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here, this did not involve a compromise of any Anthropic systems. A malicious actor used access to Cursor\u2019s marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this. The versions on our official channels including VS Code and OpenVSX are not affected and this only impacts Cursor users.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:03:43.000Z","created_at_i":1793361823,"id":50302777,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"https://www.reuters.com/business/media-telecom/cursor-says-u...
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?","title":null,"type":"comment","url":null},{"author":"HexDecOctBin","children":[{"author":"NewsaHackO","children":[],"created_at":"2026-10-30T12:12:44.000Z","created_at_i":1793362364,"id":50302854,"options":[],"parent_id":50302828,"points":null,"story_id":50300683,"text":"VS Code doesn't allow forks to use their marketplace, I think. At least with VSCodium, they don't. I think they even patch a workaround where you could download almost all extensions' .vsix files.","title":null,"type":"comment","url":null},{"author":"altbdoor","children":[],"created_at":"2026-10-30T12:23:24.000Z","created_at_i":1793363004,"id":50302948,"options":[],"parent_id":50302828,"points":null,"story_id":50302334,"text":"1. If only Cursor Marketplace version was compromised, how was it published in the first place?
2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?
The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:10:08.000Z","created_at_i":1793362208,"id":50302828,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"> Claude Code for VS Code extension on the Cursor Marketplace
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?","title":null,"type":"comment","url":null},{"author":"stbenjam","children":[{"author":"poelzi","children":[],"created_at":"2026-10-30T12:16:56.000Z","created_at_i":1793362616,"id":50302898,"options":[],"parent_id":50302838,"points":null,"story_id":50300683,"text":"This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:11:16.000Z","created_at_i":1793362276,"id":50302838,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"We still don\u2019t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.","title":null,"type":"comment","url":null},{"author":"poelzi","children":[],"created_at":"2026-10-30T12:15:11.000Z","created_at_i":1793362511,"id":50302881,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"I guess, this is why I'm building tix.im ...","title":null,"type":"comment","url":null},{"author":"jedisct1","children":[],"created_at":"2026-10-30T12:20:45.000Z","created_at_i":1793362845,"id":50302928,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Keep sending all your secrets and giving full control of your devices to Anthropic.
This is fine.","title":null,"type":"comment","url":null},{"author":"VoidWhisperer","children":[{"author":"gcr","children":[],"created_at":"2026-10-30T12:43:13.000Z","created_at_i":1793364193,"id":50303116,"options":[],"parent_id":50302930,"points":null,"story_id":50301983,"text":"Kevin Beaumont says the extension for \u201cVSCode and Cursor\u201d was compromised: https://cyberplace.social/@GossiTheDog/117528831681803563","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:21:13.000Z","created_at_i":1793362873,"id":50302930,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless","title":null,"type":"comment","url":null},{"author":"orlp","children":[{"author":"CoastalCoder","children":[{"author":"bikeshaving","children":[{"author":"masfuerte","children":[],"created_at":"2026-10-30T14:46:57.000Z","created_at_i":1793371617,"id":50304726,"options":[],"parent_id":50303707,"points":null,"story_id":50300683,"text":"I thought that couldn't really be true. I was wrong.
https://www.theverge.com/2023/9/15/23874798/microsoft-window...","title":null,"type":"comment","url":null},{"author":"seanw444","children":[],"created_at":"2026-10-30T20:57:40.000Z","created_at_i":1793393860,"id":50310047,"options":[],"parent_id":50303707,"points":null,"story_id":50300683,"text":"All I have to say is: lmao","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:37:16.000Z","created_at_i":1793367436,"id":50303707,"options":[],"parent_id":50303347,"points":null,"story_id":50300683,"text":"Windows has a builtin keyboard shortcut to open LinkedIn. This is just how they do things.","title":null,"type":"comment","url":null},{"author":"IshKebab","children":[],"created_at":"2026-10-30T13:38:02.000Z","created_at_i":1793367482,"id":50303721,"options":[],"parent_id":50303347,"points":null,"story_id":50300683,"text":""Of course we don't make mistakes. There's no need to delay our updates."","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:07:48.000Z","created_at_i":1793365668,"id":50303347,"options":[],"parent_id":50302955,"points":null,"story_id":50300683,"text":"Does anyone know Microsoft's justification for that policy?","title":null,"type":"comment","url":null},{"author":"dgellow","children":[],"created_at":"2026-10-30T13:23:44.000Z","created_at_i":1793366624,"id":50303539,"options":[],"parent_id":50302955,"points":null,"story_id":50300683,"text":"Wtf. That\u2019s its own scandal","title":null,"type":"comment","url":null},{"author":"delis-thumbs-7e","children":[],"created_at":"2026-10-30T13:39:36.000Z","created_at_i":1793367576,"id":50303741,"options":[],"parent_id":50302955,"points":null,"story_id":50300683,"text":"I started experimenting with more traditional text editors since last spring and am happy to say, that I\u2019m a happy user of Neovim now.","title":null,"type":"comment","url":null},{"author":"dcrazy","children":[],"created_at":"2026-10-30T13:49:56.000Z","created_at_i":1793368196,"id":50303860,"options":[],"parent_id":50302955,"points":null,"story_id":50300683,"text":"If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.
Though Anthropic is claiming that the compromised package was published solely to Cursor\u2019s marketplace, not not Microsoft\u2019s.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:24:03.000Z","created_at_i":1793363043,"id":50302955,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...","title":null,"type":"comment","url":null},{"author":"numbsafari","children":[{"author":"paaloeye","children":[],"created_at":"2026-10-30T12:59:09.000Z","created_at_i":1793365149,"id":50303241,"options":[],"parent_id":50302970,"points":null,"story_id":50300683,"text":"It's karma I guess","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:25:54.000Z","created_at_i":1793363154,"id":50302970,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"This puts an entirely new spin on Elon trolling Binance on Twitter.","title":null,"type":"comment","url":null},{"author":"efficax","children":[],"created_at":"2026-10-30T12:33:23.000Z","created_at_i":1793363603,"id":50303033,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps","title":null,"type":"comment","url":null},{"author":"xteam","children":[],"created_at":"2026-10-30T12:35:17.000Z","created_at_i":1793363717,"id":50303045,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"\u265f","title":null,"type":"comment","url":null},{"author":"rvz","children":[],"created_at":"2026-10-30T12:45:49.000Z","created_at_i":1793364349,"id":50303139,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"This is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.","title":null,"type":"comment","url":null},{"author":"yubblegum","children":[{"author":"stingraycharles","children":[{"author":"lesspassiveobse","children":[],"created_at":"2026-10-30T13:01:17.000Z","created_at_i":1793365277,"id":50303269,"options":[],"parent_id":50303212,"points":null,"story_id":50300683,"text":"Not only launch sshd. They set up a reverse tunnel connection.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:56:10.000Z","created_at_i":1793364970,"id":50303212,"options":[],"parent_id":50303141,"points":null,"story_id":50300683,"text":"And try to launch sshd, right? Think of all the other things they could have done\u2026","title":null,"type":"comment","url":null},{"author":"JoBrad","children":[],"created_at":"2026-10-30T18:13:10.000Z","created_at_i":1793383990,"id":50307950,"options":[],"parent_id":50303141,"points":null,"story_id":50300683,"text":"Except this doesn\u2019t impact VSCode at all, apparently.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:45:58.000Z","created_at_i":1793364358,"id":50303141,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"The original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys.
https://phorion.io/blog/offical-claude-code-vsx-compromise/","title":null,"type":"comment","url":null},{"author":"anonymous908213","children":[{"author":"Aboutplants","children":[{"author":"anonymous908213","children":[{"author":"Aboutplants","children":[],"created_at":"2026-10-30T13:35:48.000Z","created_at_i":1793367348,"id":50303678,"options":[],"parent_id":50303508,"points":null,"story_id":50300683,"text":"Incredible. Looking a bit more and more like this was the actual case. Wild stuff","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:21:18.000Z","created_at_i":1793366478,"id":50303508,"options":[],"parent_id":50303338,"points":null,"story_id":50300683,"text":"It does. The compromised extension was published about 11 hours before Binance's coins went zoop, Binance blamed a compromised developer laptop, and OP pointed out that their hiring page explicitly notes developers will be using Cursor with Claude Code for "development efficiency".","title":null,"type":"comment","url":null},{"author":"6thbit","children":[],"created_at":"2026-10-30T17:03:34.000Z","created_at_i":1793379814,"id":50306825,"options":[],"parent_id":50303338,"points":null,"story_id":50300683,"text":"It lines up and fits so well that it'd scare me more they wouldn't be related than if they were. At least we'd know the vector.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:07:02.000Z","created_at_i":1793365622,"id":50303338,"options":[],"parent_id":50303162,"points":null,"story_id":50300683,"text":"Is that the rumor? Does the timing line up?","title":null,"type":"comment","url":null},{"author":"nater5000","children":[],"created_at":"2026-10-30T15:12:26.000Z","created_at_i":1793373146,"id":50305058,"options":[],"parent_id":50303162,"points":null,"story_id":50300683,"text":">hats off to our new billionaire friend
As if this wasn't coordinated by a team directed by the government of North Korea.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:48:35.000Z","created_at_i":1793364515,"id":50303162,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.","title":null,"type":"comment","url":null},{"author":"paaloeye","children":[],"created_at":"2026-10-30T12:51:16.000Z","created_at_i":1793364676,"id":50303181,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Another reason for not using VS Code and derived and all their mess of extensions.\nI'm glad running Claude Code in Ghostty/Terminal is not affected.","title":null,"type":"comment","url":null},{"author":"jitbit","children":[{"author":"stingraycharles","children":[{"author":"thewhitetulip","children":[],"created_at":"2026-10-30T18:43:14.000Z","created_at_i":1793385794,"id":50308373,"options":[],"parent_id":50303231,"points":null,"story_id":50300683,"text":"An honest post mortem will come any day now... Any day post the IPO probably","title":null,"type":"comment","url":null},{"author":"FergusArgyll","children":[],"created_at":"2026-10-30T18:49:29.000Z","created_at_i":1793386169,"id":50308460,"options":[],"parent_id":50303231,"points":null,"story_id":50300683,"text":"This has nothing to do with anthropic. One (or two) distribution channels were hacked. The hackers decided to distribute their malware through the claude extension, probably because it's popular.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:57:39.000Z","created_at_i":1793365059,"id":50303231,"options":[],"parent_id":50303182,"points":null,"story_id":50300683,"text":"I\u2019d expect nothing less than a post mortem on how this happened to be honest.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T12:51:28.000Z","created_at_i":1793364688,"id":50303182,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Oh god... this needs more attention
An official announcement from Anthropic would be nice!","title":null,"type":"comment","url":null},{"author":"lxgr","children":[],"created_at":"2026-10-30T12:55:44.000Z","created_at_i":1793364944,"id":50303209,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Something very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.","title":null,"type":"comment","url":null},{"author":"reilly3000","children":[],"created_at":"2026-10-30T12:58:20.000Z","created_at_i":1793365100,"id":50303235,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power\u2019s all of the VSCode fork\u2019s extensions needs.","title":null,"type":"comment","url":null},{"author":"blondie9x","children":[],"created_at":"2026-10-30T13:03:46.000Z","created_at_i":1793365426,"id":50303302,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"From https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.
Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.","title":null,"type":"comment","url":null},{"author":"DEADF007","children":[{"author":"anonymous908213","children":[],"created_at":"2026-10-30T13:25:57.000Z","created_at_i":1793366757,"id":50303563,"options":[],"parent_id":50303380,"points":null,"story_id":50300683,"text":"> how are you supposed to defend yourself against attacks like this?
You can try not installing malware like Claude Code or, if you absolutely must, doing it in a sandbox.","title":null,"type":"comment","url":null},{"author":"tripleee","children":[{"author":"6thbit","children":[{"author":"tripleee","children":[{"author":"6thbit","children":[],"created_at":"2026-10-30T18:00:53.000Z","created_at_i":1793383253,"id":50307767,"options":[],"parent_id":50307158,"points":null,"story_id":50300683,"text":"Those sound good, but say in this case you had the compromised extension which had its own ssh key to an IP that wasn't yours. \nI'm not sure how you easily prevent that connection without preventing the ones you need through sandboxing. Maybe a firewall/very specific network filtering in allowlist?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T17:23:30.000Z","created_at_i":1793381010,"id":50307158,"options":[],"parent_id":50306926,"points":null,"story_id":50300683,"text":"In this case you could give it its own SSH key, and only allow that key to access what you want. I actually do that, it doesn't share my own SSH key. It also has its own Github account instead of getting access to mine.
For access to services, most allow tokens to be scoped to only allow the things you want.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T17:10:13.000Z","created_at_i":1793380213,"id":50306926,"options":[],"parent_id":50304534,"points":null,"story_id":50300683,"text":"How do you sandbox this usecase?
Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:35:42.000Z","created_at_i":1793370942,"id":50304534,"options":[],"parent_id":50303380,"points":null,"story_id":50300683,"text":"I thoroughly sandbox agents to their own physical machine, and they don't have access to anything that would ruin me.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:10:55.000Z","created_at_i":1793365855,"id":50303380,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"I don't care anymore, how are you supposed to defend yourself against attacks like this? Come and hack me.","title":null,"type":"comment","url":null},{"author":"try-working","children":[],"created_at":"2026-10-30T13:13:13.000Z","created_at_i":1793365993,"id":50303413,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":""Software is solved. Bugs are not yet solved"","title":null,"type":"comment","url":null},{"author":"paxy","children":[{"author":"strix_varius","children":[{"author":"paxy","children":[{"author":"alienbaby","children":[{"author":"paxy","children":[],"created_at":"2026-10-30T16:44:45.000Z","created_at_i":1793378685,"id":50306510,"options":[],"parent_id":50306223,"points":null,"story_id":50300683,"text":"That\u2019s what the title said before it was changed.
Two out of the three links in the post still say exactly that.
That\u2019s also what the majority of the comments here are saying, likely because they read the first two.
Is that your \u201cnobody\u201d?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:25:34.000Z","created_at_i":1793377534,"id":50306223,"options":[],"parent_id":50304445,"points":null,"story_id":50300683,"text":"nobody is saying anthropic was hacked?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:29:55.000Z","created_at_i":1793370595,"id":50304445,"options":[],"parent_id":50304242,"points":null,"story_id":50300683,"text":"I don't see "Anthropic hacked!" anywhere in that post. This extension was uploaded to the Cursor marketplace.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:16:05.000Z","created_at_i":1793369765,"id":50304242,"options":[],"parent_id":50303464,"points":null,"story_id":50300683,"text":"https://cursor.com/blog/claude-code-extension-security-notic...","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:18:36.000Z","created_at_i":1793366316,"id":50303464,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Is there any proof of this or are we just upvoting garbage?","title":null,"type":"comment","url":null},{"author":"maayank","children":[],"created_at":"2026-10-30T13:20:00.000Z","created_at_i":1793366400,"id":50303486,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Have we just witnessed the greatest lateral movement in cybersecurity history?\nhttps://x.com/dinodaizovi/status/2116125553665458463?a=D1DiF...","title":null,"type":"comment","url":null},{"author":"rietta","children":[],"created_at":"2026-10-30T13:21:15.000Z","created_at_i":1793366475,"id":50303505,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Reading the report alone:\n"First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."
A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.","title":null,"type":"comment","url":null},{"author":"kirth_gersen","children":[{"author":"gruez","children":[],"created_at":"2026-10-30T13:24:26.000Z","created_at_i":1793366666,"id":50303546,"options":[],"parent_id":50303513,"points":null,"story_id":50300683,"text":"That's not the actual hack though, it's with an extension. You could have gotten compromised this way through an extension for git or whatever.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:21:45.000Z","created_at_i":1793366505,"id":50303513,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"This is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.","title":null,"type":"comment","url":null},{"author":"_hmj","children":[{"author":"cryptonym","children":[],"created_at":"2026-10-30T15:52:52.000Z","created_at_i":1793375572,"id":50305706,"options":[],"parent_id":50303542,"points":null,"story_id":50300683,"text":"Maybe because the tools aren't of much help. This is all theory but when you want to do it it's custom solutions and duct tape.
There is too much friction when you try to isolate things. You have to do custom stuff then the company won't let you virtualize (can't install stuff...) or won't allow you to enroll the vm and will threaten you if you dev on an OS that is not enrolled.
Best you can get from state-of-the-art-frontier-top-it-company is an IDE with an exec sandbox leaking like an hourglass.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:24:07.000Z","created_at_i":1793366647,"id":50303542,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.
Still, it\u2019s hardly a surprise that best practices are rarely followed with any consistency.","title":null,"type":"comment","url":null},{"author":"villgax","children":[{"author":"meindnoch","children":[],"created_at":"2026-10-30T14:05:57.000Z","created_at_i":1793369157,"id":50304095,"options":[],"parent_id":50303633,"points":null,"story_id":50300683,"text":"Because we need velocity. If we don't have velocity, we die.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T13:32:13.000Z","created_at_i":1793367133,"id":50303633,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"What I dont understand is why the hell do these extensions & clis need to update every damn day. clearly there's no new models everyday, what the actual f.","title":null,"type":"comment","url":null},{"author":"soundworlds","children":[],"created_at":"2026-10-30T13:32:34.000Z","created_at_i":1793367154,"id":50303636,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"The descriptions around this are very confusing. Is this specifically the Cursor version, or the regular VS Code version too?","title":null,"type":"comment","url":null},{"author":"paaloeye","children":[],"created_at":"2026-10-30T13:44:04.000Z","created_at_i":1793367844,"id":50303796,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"P(doom) crowd say Anthropic has not zero chance to destroy humanity. \nWhat it is, the VS Code Extension Marketplace, including Cursor's, must be bigger.","title":null,"type":"comment","url":null},{"author":"jacquesm","children":[],"created_at":"2026-10-30T13:49:38.000Z","created_at_i":1793368178,"id":50303856,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Anthropic is a weird company. On the one hand they have this messianic thing about their super intelligence, on the other hand it is incapable of keeping their own house secure. But you should trust it.","title":null,"type":"comment","url":null},{"author":"pier25","children":[],"created_at":"2026-10-30T13:50:04.000Z","created_at_i":1793368204,"id":50303864,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"God only knows how many skeletons like this are in Bun now","title":null,"type":"comment","url":null},{"author":"Handy-Man","children":[],"created_at":"2026-10-30T14:02:48.000Z","created_at_i":1793368968,"id":50304043,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"That's not official extension though? Misleading title","title":null,"type":"comment","url":null},{"author":"felixrieseberg","children":[{"author":"ashishb","children":[{"author":"hobo123","children":[{"author":"ashishb","children":[{"author":"hobo123","children":[],"created_at":"2026-10-30T16:01:57.000Z","created_at_i":1793376117,"id":50305838,"options":[],"parent_id":50304408,"points":null,"story_id":50300683,"text":"That looks really nice, including the VSCode/Mac wrapper.","title":null,"type":"comment","url":null},{"author":"JoBrad","children":[],"created_at":"2026-10-30T18:07:55.000Z","created_at_i":1793383675,"id":50307877,"options":[],"parent_id":50304408,"points":null,"story_id":50300683,"text":"I\u2019m fine with that. I use a top-level directory for all of my code, and restricting extension access to that directory is a great idea.","title":null,"type":"comment","url":null},{"author":"none_to_remain","children":[],"created_at":"2026-10-30T19:26:07.000Z","created_at_i":1793388367,"id":50308978,"options":[],"parent_id":50304408,"points":null,"story_id":50300683,"text":"If all the code and data eventually move into the dedicated user account, why wouldn't it also eventually move into the container/vm?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:26:38.000Z","created_at_i":1793370398,"id":50304408,"options":[],"parent_id":50304313,"points":null,"story_id":50300683,"text":"Dedicated user account does not work as eventually all your code and data will move under that.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:20:28.000Z","created_at_i":1793370028,"id":50304313,"options":[],"parent_id":50304251,"points":null,"story_id":50300683,"text":"Probably a good idea to only run LLMs with a dedicated user account, or in a container.","title":null,"type":"comment","url":null},{"author":"no-name-here","children":[],"created_at":"2026-10-30T15:14:44.000Z","created_at_i":1793373284,"id":50305094,"options":[],"parent_id":50304251,"points":null,"story_id":50300683,"text":"For locally installed Code / Code-fork extensions, there is not any concept of permissions (at least on Windows or MacOS (+ the 3rd party code-server running on Linux)), correct?","title":null,"type":"comment","url":null},{"author":"fg137","children":[],"created_at":"2026-10-30T16:18:07.000Z","created_at_i":1793377087,"id":50306090,"options":[],"parent_id":50304251,"points":null,"story_id":50300683,"text":"It shouldn't.
Be as close as AGI we are (/s), this issue from 2018 is still open:
https://github.com/microsoft/vscode/issues/52116
I don't know what we are doing.","title":null,"type":"comment","url":null},{"author":"idontwantthis","children":[],"created_at":"2026-10-30T18:01:49.000Z","created_at_i":1793383309,"id":50307786,"options":[],"parent_id":50304251,"points":null,"story_id":50300683,"text":"Does it? It asks for permission to use whatever directory you call it in.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:16:39.000Z","created_at_i":1793369799,"id":50304251,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"The extensions does not need full access to the laptop.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.","title":null,"type":"comment","url":null},{"author":"fishfasell","children":[{"author":"ddworken","children":[{"author":"junofan","children":[{"author":"no-name-here","children":[],"created_at":"2026-10-30T15:28:39.000Z","created_at_i":1793374119,"id":50305302,"options":[],"parent_id":50304968,"points":null,"story_id":50300683,"text":"> Cursor routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX.
https://cursor.com/help/customization/extensions","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:06:46.000Z","created_at_i":1793372806,"id":50304968,"options":[],"parent_id":50304489,"points":null,"story_id":50300683,"text":"Is the extension not Anthropic.claude-code developed by Anthropic? Been a while since I used Cursor.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:33:09.000Z","created_at_i":1793370789,"id":50304489,"options":[],"parent_id":50304277,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:18:27.000Z","created_at_i":1793369907,"id":50304277,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?","title":null,"type":"comment","url":null},{"author":"JeremyNT","children":[{"author":"nikanj","children":[{"author":"lifeisloving","children":[{"author":"user43928","children":[{"author":"quantumwannabe","children":[],"created_at":"2026-10-30T16:14:43.000Z","created_at_i":1793376883,"id":50306040,"options":[],"parent_id":50304857,"points":null,"story_id":50300683,"text":"The team behind Cursor and their data were worth $60 billion to Musk, not the app itself.","title":null,"type":"comment","url":null},{"author":"criley2","children":[],"created_at":"2026-10-30T17:51:49.000Z","created_at_i":1793382709,"id":50307619,"options":[],"parent_id":50304857,"points":null,"story_id":50300683,"text":"Considering that the biggest and most successful play for SpaceXAI in the AI space has been "Sell compute to Anthropic" I also wouldn't say that all of the grok junk has been obviously successful, either.","title":null,"type":"comment","url":null},{"author":"lifeisloving","children":[],"created_at":"2026-10-30T22:24:48.000Z","created_at_i":1793399088,"id":50310920,"options":[],"parent_id":50304857,"points":null,"story_id":50300683,"text":"The only people I see say they use Grokbot are AI psychosis people in the replies of Musk's tweets.
Normal people use muse/grok bot for less than a month and go back to living their life without an assisatnt they survived without for decades prior.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:58:18.000Z","created_at_i":1793372298,"id":50304857,"options":[],"parent_id":50304432,"points":null,"story_id":50300683,"text":"Cursor made Grok Bot and is working on the Grok models.
I wouldn't say it's obviously unsuccessful.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:28:31.000Z","created_at_i":1793370511,"id":50304432,"options":[],"parent_id":50304365,"points":null,"story_id":50300683,"text":"I dont know a single person who uses this tool (but im sure there are some) our annual subs recently ran out, I hadnt used mine in 6 months, we did not renew.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:23:14.000Z","created_at_i":1793370194,"id":50304365,"options":[],"parent_id":50304326,"points":null,"story_id":50300683,"text":"I believe the value add was $60bn in just 4 years https://www.linkedin.com/posts/sytaylor_wild-cursor-just-sol...","title":null,"type":"comment","url":null},{"author":"sunaookami","children":[{"author":"airhangerf15","children":[{"author":"anygivnthursday","children":[{"author":"numbsafari","children":[{"author":"kemotep","children":[],"created_at":"2026-10-30T17:02:52.000Z","created_at_i":1793379772,"id":50306810,"options":[],"parent_id":50306247,"points":null,"story_id":50300683,"text":"If Microsoft was any good the entire IT industry would collapse. Millions of high paying careers are built on decades of fixing the garbage that comes out of Redmond. Probably a trillion dollars worth of businesses selling software and support to companies running Microsoft would evaporate as soon as Microsoft doesn\u2019t continue their current efforts.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:27:13.000Z","created_at_i":1793377633,"id":50306247,"options":[],"parent_id":50306115,"points":null,"story_id":50300683,"text":"> > I'm still surprised people use CrowdStrike
> I mean, LastPass is still in business...
I mean, Microsoft is still experiencing massive growth.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:19:33.000Z","created_at_i":1793377173,"id":50306115,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"> I'm still surprised people use CrowdStrike
I mean, LastPass is still in business...","title":null,"type":"comment","url":null},{"author":"nightski","children":[],"created_at":"2026-10-30T17:47:22.000Z","created_at_i":1793382442,"id":50307545,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"If I had to guess it's that very few people use it for actual security guarantees and most use it just to be able to fill out the questionnaire or compliance box saying "we do this".","title":null,"type":"comment","url":null},{"author":"JoBrad","children":[],"created_at":"2026-10-30T18:04:18.000Z","created_at_i":1793383458,"id":50307823,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"I remember when Crowdstrike was all about mobilizing your spare computer to DDOS the bad guys.","title":null,"type":"comment","url":null},{"author":"lfglopes","children":[],"created_at":"2026-10-30T18:25:55.000Z","created_at_i":1793384755,"id":50308150,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"I had to fill a security questionnaire today. One of the questions was
"Do you use crowdstrike falcon?"","title":null,"type":"comment","url":null},{"author":"Melatonic","children":[],"created_at":"2026-10-30T18:49:24.000Z","created_at_i":1793386164,"id":50308459,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"What do you suggest instead ?
Their Linux stuff has gotten much better but besides the (insanely huge) recent windows debacle I've found them to be a great product","title":null,"type":"comment","url":null},{"author":"tredre3","children":[{"author":"darkwi11ow","children":[],"created_at":"2026-10-30T21:55:06.000Z","created_at_i":1793397306,"id":50310660,"options":[],"parent_id":50309741,"points":null,"story_id":50300683,"text":"I think gp meant DKMS (https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support). It allows for things like using same proprietary device drivers across many Linux kernels.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T20:30:46.000Z","created_at_i":1793392246,"id":50309741,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"> They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently)
Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.
> the service ran as root, it UPDATED ITS OWN BINARIES as root!
Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?","title":null,"type":"comment","url":null},{"author":"burger_moon","children":[],"created_at":"2026-10-30T20:34:10.000Z","created_at_i":1793392450,"id":50309784,"options":[],"parent_id":50304870,"points":null,"story_id":50300683,"text":"Crowdstrike and Solarwinds are still being used by nearly every fed govt agency today. It's amazing really that despite everything they still get to suck up our funds.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:59:49.000Z","created_at_i":1793372389,"id":50304870,"options":[],"parent_id":50304405,"points":null,"story_id":50300683,"text":"I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.
Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.
I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.","title":null,"type":"comment","url":null},{"author":"asveikau","children":[],"created_at":"2026-10-30T20:06:42.000Z","created_at_i":1793390802,"id":50309448,"options":[],"parent_id":50304405,"points":null,"story_id":50300683,"text":"I forgot entirely about superfish. That takes me back.
My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.
I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:26:32.000Z","created_at_i":1793370392,"id":50304405,"options":[],"parent_id":50304326,"points":null,"story_id":50300683,"text":">Perhaps it will be the death knell
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.","title":null,"type":"comment","url":null},{"author":"Aboutplants","children":[{"author":"gpm","children":[],"created_at":"2026-10-30T15:03:51.000Z","created_at_i":1793372631,"id":50304923,"options":[],"parent_id":50304416,"points":null,"story_id":50300683,"text":"Who says there wasn't?
A lot of the most valuable SpaceX IP (at least to the big "advanced persistent threat" hackers) is probably related to military secrets, information to let you spy on/disable/control star shield/link, and so on. Not things we'd find out about as the general public.","title":null,"type":"comment","url":null},{"author":"numbsafari","children":[],"created_at":"2026-10-30T15:06:23.000Z","created_at_i":1793372783,"id":50304962,"options":[],"parent_id":50304416,"points":null,"story_id":50300683,"text":"I mean, who says it wasn't an inside job...
https://www.cnbc.com/2026/10/30/binance-hack-elon-musk-tesla...","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:27:27.000Z","created_at_i":1793370447,"id":50304416,"options":[],"parent_id":50304326,"points":null,"story_id":50300683,"text":"Seeing as SpaceX owns Curser, I\u2019m surprised there wasn\u2019t a hack on SpaceX\u2026 Yet","title":null,"type":"comment","url":null},{"author":"bhouston","children":[],"created_at":"2026-10-30T18:11:27.000Z","created_at_i":1793383887,"id":50307920,"options":[],"parent_id":50304326,"points":null,"story_id":50300683,"text":"I realized this earlier this year and dumped Cursor for just vscode along with 20x subs to Claude and OpenAI. Much cheaper and nothing of value was lost.","title":null,"type":"comment","url":null},{"author":"satellites","children":[],"created_at":"2026-10-30T18:25:13.000Z","created_at_i":1793384713,"id":50308136,"options":[],"parent_id":50304326,"points":null,"story_id":50300683,"text":"Cursor was the first AI coding tool I used that had a "wow" factor and got me to switch over from typing out most of my code to having AI write most of it. But then when I used Claude Code for the first time, I never went back to Cursor.
I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:20:49.000Z","created_at_i":1793370049,"id":50304326,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"If this isn't a damning indictment of Cursor, I don't know what is. Perhaps it will be the death knell.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.","title":null,"type":"comment","url":null},{"author":"elevation","children":[],"created_at":"2026-10-30T14:23:47.000Z","created_at_i":1793370227,"id":50304369,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"> We\u2019re working with Cursor on this incident
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.","title":null,"type":"comment","url":null},{"author":"ipsento606","children":[{"author":"wky","children":[{"author":"gamer191","children":[],"created_at":"2026-10-30T16:41:59.000Z","created_at_i":1793378519,"id":50306465,"options":[],"parent_id":50304559,"points":null,"story_id":50300683,"text":"It wasn't on OpenVSX according to https://news.ycombinator.com/item?id=50305148","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:36:58.000Z","created_at_i":1793371018,"id":50304559,"options":[],"parent_id":50304406,"points":null,"story_id":50300683,"text":"Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases:
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
[0] https://cursor.com/help/customization/extensions","title":null,"type":"comment","url":null},{"author":"ddworken","children":[{"author":"consumer451","children":[],"created_at":"2026-10-30T16:03:57.000Z","created_at_i":1793376237,"id":50305875,"options":[],"parent_id":50304585,"points":null,"story_id":50300683,"text":"I am curious to see how difficult it will be to get this message across on Twitter. $44B seems like a bargain at this point.","title":null,"type":"comment","url":null},{"author":"bostik","children":[{"author":"nitrix","children":[],"created_at":"2026-10-30T20:59:25.000Z","created_at_i":1793393965,"id":50310064,"options":[],"parent_id":50308566,"points":null,"story_id":50300683,"text":"You're confused. It's not Anthropic's responsibility to monitor and fix everything that's said correctly or incorrectly about them. They're doing excellent given what they're capable to do in this situation.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T18:56:53.000Z","created_at_i":1793386613,"id":50308566,"options":[],"parent_id":50304585,"points":null,"story_id":50300683,"text":"This is not directed at you personally but Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:38:28.000Z","created_at_i":1793371108,"id":50304585,"options":[],"parent_id":50304406,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.","title":null,"type":"comment","url":null},{"author":"ruined","children":[],"created_at":"2026-10-30T16:12:07.000Z","created_at_i":1793376727,"id":50305997,"options":[],"parent_id":50304406,"points":null,"story_id":50300683,"text":"there is NO LEGIT v2.1.313
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148","title":null,"type":"comment","url":null},{"author":"sarjann","children":[{"author":"chrisweekly","children":[],"created_at":"2026-10-30T19:40:44.000Z","created_at_i":1793389244,"id":50309154,"options":[],"parent_id":50308979,"points":null,"story_id":50300683,"text":"There's been too much guessing already. Anthropic employees answered in this thread almost 4h before your response.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T19:26:18.000Z","created_at_i":1793388378,"id":50308979,"options":[],"parent_id":50304406,"points":null,"story_id":50300683,"text":"My guess is someone published an extension on vscode/cursor claiming to be Anthropic when it wasn't. Kind of like me publishing an app called Youtube on the app store, being accepted by Apple and having people download my malicious app called Youtube.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:26:32.000Z","created_at_i":1793370392,"id":50304406,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"The situation is confusing, so can I please confirm the following:
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?","title":null,"type":"comment","url":null},{"author":"qwrkll","children":[{"author":"perching_aix","children":[],"created_at":"2026-10-30T14:47:53.000Z","created_at_i":1793371673,"id":50304744,"options":[],"parent_id":50304716,"points":null,"story_id":50300683,"text":"I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.
Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.","title":null,"type":"comment","url":null},{"author":"Handy-Man","children":[],"created_at":"2026-10-30T14:49:33.000Z","created_at_i":1793371773,"id":50304770,"options":[],"parent_id":50304716,"points":null,"story_id":50300683,"text":"313 was never released lol https://github.com/anthropics/claude-code/releases","title":null,"type":"comment","url":null},{"author":"ddworken","children":[],"created_at":"2026-10-30T14:50:52.000Z","created_at_i":1793371852,"id":50304793,"options":[],"parent_id":50304716,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:46:12.000Z","created_at_i":1793371572,"id":50304716,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"Why was version 2.1.313 silently deleted from OpenVSX, Visual Studio Marketplace and Cursor then?
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...","title":null,"type":"comment","url":null},{"author":"skinfaxi","children":[{"author":"ddworken","children":[{"author":"skinfaxi","children":[],"created_at":"2026-10-30T18:45:33.000Z","created_at_i":1793385933,"id":50308404,"options":[],"parent_id":50305148,"points":null,"story_id":50300683,"text":"Thank you for the clarification and my apologies for misspeaking, as the version indeed does not appear to have been yanked but entirely absent.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:18:24.000Z","created_at_i":1793373504,"id":50305148,"options":[],"parent_id":50304920,"points":null,"story_id":50300683,"text":"Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:03:40.000Z","created_at_i":1793372620,"id":50304920,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"Why was the npm version 2.1.313 yanked?
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...","title":null,"type":"comment","url":null},{"author":"officeplant","children":[],"created_at":"2026-10-30T15:11:49.000Z","created_at_i":1793373109,"id":50305047,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"smooth sloperators, smooooooooth sloperattorrrrrssss","title":null,"type":"comment","url":null},{"author":"jitbit","children":[{"author":"chunky1994","children":[{"author":"jitbit","children":[],"created_at":"2026-10-30T18:50:00.000Z","created_at_i":1793386200,"id":50308466,"options":[],"parent_id":50306056,"points":null,"story_id":50300683,"text":"Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"
Which is exactly the opposite of what happened today.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T16:15:35.000Z","created_at_i":1793376935,"id":50306056,"options":[],"parent_id":50305798,"points":null,"story_id":50300683,"text":"Apparently it is public: https://cursor.com/help/customization/extensions
They use a proxy in front of OpenVSX\u2026purportedly for better security, the irony writes itself.","title":null,"type":"comment","url":null},{"author":"Lazare","children":[],"created_at":"2026-10-30T19:58:14.000Z","created_at_i":1793390294,"id":50309347,"options":[],"parent_id":50305798,"points":null,"story_id":50300683,"text":"Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:58:43.000Z","created_at_i":1793375923,"id":50305798,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"Ok, so... Summing this up
- Cursor (obviously) is not using MSFT vscode extensions library\n- Cursor (apparently) is not using Open-VSX either!\n- Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) \n- THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)","title":null,"type":"comment","url":null},{"author":"nailer","children":[],"created_at":"2026-10-30T18:21:26.000Z","created_at_i":1793384486,"id":50308079,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"> The versions on our official channels are not affected and this only impacts Cursor users.
Is Cursor not an official channel for Claude?","title":null,"type":"comment","url":null},{"author":"saidnooneever","children":[{"author":"john_strinlai","children":[{"author":"jaykru","children":[],"created_at":"2026-10-30T18:35:33.000Z","created_at_i":1793385333,"id":50308278,"options":[],"parent_id":50308265,"points":null,"story_id":50300683,"text":"I think the concern is that it could be seen as minimizing the harm done to those affected, but I personally think this is kind of a hypersensitive overcorrection :P","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T18:33:49.000Z","created_at_i":1793385229,"id":50308265,"options":[],"parent_id":50308120,"points":null,"story_id":50300683,"text":">I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.
why do people cry if you say "only"?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T18:24:06.000Z","created_at_i":1793384646,"id":50308120,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.","title":null,"type":"comment","url":null},{"author":"f0e4c2f7","children":[],"created_at":"2026-10-30T20:14:09.000Z","created_at_i":1793391249,"id":50309523,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"All these security issues have made me want to build more of my own slimmed down tools. It would be great if there were better ways to use claude code with my own minimal harness and still have access to the pro plan.","title":null,"type":"comment","url":null},{"author":"tzone","children":[{"author":"IshKebab","children":[{"author":"tehlike","children":[{"author":"baxtr","children":[],"created_at":"2026-10-30T20:57:53.000Z","created_at_i":1793393873,"id":50310050,"options":[],"parent_id":50309879,"points":null,"story_id":50300683,"text":"HN has a dedicated upvote functionality.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T20:43:01.000Z","created_at_i":1793392981,"id":50309879,"options":[],"parent_id":50309863,"points":null,"story_id":50300683,"text":"+1.","title":null,"type":"comment","url":null},{"author":"theteapot","children":[],"created_at":"2026-10-30T20:59:33.000Z","created_at_i":1793393973,"id":50310067,"options":[],"parent_id":50309863,"points":null,"story_id":50300683,"text":"I think he's saying (erroneously) Anthropic owns Cursor. Reading this claude.com page [1] hawking Cursor you could be forgiven for forming that impression.
[1]: https://claude.com/marketplace/agents-products/cursor","title":null,"type":"comment","url":null},{"author":"ethanzh","children":[{"author":"junofan","children":[{"author":"weego","children":[],"created_at":"2026-10-30T21:47:40.000Z","created_at_i":1793396860,"id":50310587,"options":[],"parent_id":50310512,"points":null,"story_id":50300683,"text":"It's literally not like that at all.
If Costco made iPhones under license from Apple outside of the Apple supply chain and they all exploded, while the Apple name is involved they have no direct liability or responsibility.","title":null,"type":"comment","url":null},{"author":"true_religion","children":[{"author":"plaguuuuuu","children":[],"created_at":"2026-10-30T22:05:34.000Z","created_at_i":1793397934,"id":50310754,"options":[],"parent_id":50310602,"points":null,"story_id":50300683,"text":"It's a lot more like a bunch of people bought Cisco networking equipment and then the NSA secretly intercepted shipments, implanted surveillance backdoors, then resealed the boxes and sent them on to unsuspecting overseas targets.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T21:49:11.000Z","created_at_i":1793396951,"id":50310602,"options":[],"parent_id":50310512,"points":null,"story_id":50300683,"text":"No, it's like 5,000 people bought something that Costco called the iPhone but really was EvilPhone Max+ by EvilCorp. Costco should be on the hook for accepting the phones without properly checking they weren't bombs in disguise.
Apple would be 100% right to say "they're not our phone, we didn't make them, the branding was a lie."
Of course if Cursor actually has a direct connection with Anthropic, and Anthropic lost control of their keys... it's a different story and their employee is just obfuscating up there.","title":null,"type":"comment","url":null},{"author":"kji","children":[],"created_at":"2026-10-30T21:49:37.000Z","created_at_i":1793396977,"id":50310606,"options":[],"parent_id":50310512,"points":null,"story_id":50300683,"text":"This is misleading; a better analogy would be if someone swapped out all iPhones in the store with fake ones.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T21:39:44.000Z","created_at_i":1793396384,"id":50310512,"options":[],"parent_id":50310094,"points":null,"story_id":50300683,"text":"It\u2019s like if 5,000 people bought iPhones at Costco and they all exploded, and Apple says \u201cwell we didn\u2019t sell them.\u201d Sure, but maybe not the perfect thing to communicate immediately.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T21:02:08.000Z","created_at_i":1793394128,"id":50310094,"options":[],"parent_id":50309863,"points":null,"story_id":50300683,"text":"I don't think they're trying to spin this as Anthropic being compromised, but I do think they're correct in saying this is Anthropic's problem to deal with now, regardless of the fact that they're not responsible for the root cause.","title":null,"type":"comment","url":null},{"author":"abofh","children":[],"created_at":"2026-10-30T21:15:50.000Z","created_at_i":1793394950,"id":50310240,"options":[],"parent_id":50309863,"points":null,"story_id":50300683,"text":"That is not what was written; what was described was anthropic losing control over their cursor account - perhaps a key compromise, developer laptop compromise, or a fault in cursor, but of the three, the language suggests the first two.","title":null,"type":"comment","url":null},{"author":"d0mine","children":[],"created_at":"2026-10-30T21:19:08.000Z","created_at_i":1793395148,"id":50310282,"options":[],"parent_id":50309863,"points":null,"story_id":50300683,"text":"If you decided to use an umbrella to protect something during a hurricane and umbrella breaks and your thing is ruined. Whose fault is that?
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T20:42:03.000Z","created_at_i":1793392923,"id":50309863,"options":[],"parent_id":50309617,"points":null,"story_id":50300683,"text":"That's nonsense. If what felixrieseberg said is true this is very clearly a compromise of Cursor and not Anthropic. Trying to spin it as a compromise of Anthropic is absurd.","title":null,"type":"comment","url":null},{"author":"consumer451","children":[],"created_at":"2026-10-30T20:51:34.000Z","created_at_i":1793393494,"id":50309985,"options":[],"parent_id":50309617,"points":null,"story_id":50300683,"text":"Are you claiming that the Cursor extension store - marketplace.cursorapi.com - does not add their own proxy to Open VSX?
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.","title":null,"type":"comment","url":null},{"author":"AtNightWeCode","children":[],"created_at":"2026-10-30T21:25:08.000Z","created_at_i":1793395508,"id":50310352,"options":[],"parent_id":50309617,"points":null,"story_id":50300683,"text":"That is simply not how software works.","title":null,"type":"comment","url":null},{"author":"darkwi11ow","children":[],"created_at":"2026-10-30T21:46:58.000Z","created_at_i":1793396818,"id":50310578,"options":[],"parent_id":50309617,"points":null,"story_id":50300683,"text":"The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology exists for ages and prominently featured in all mainstream Linux distributions. Cursor, Anthropic and other openvsx users need to work with Eclipse Foundation to make this happen.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T20:21:31.000Z","created_at_i":1793391691,"id":50309617,"options":[],"parent_id":50304129,"points":null,"story_id":50300683,"text":"You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:08:52.000Z","created_at_i":1793369332,"id":50304129,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Felix from Anthropic here.
We\u2019re working with Cursor on this incident, but it wasn\u2019t a compromise of Anthropic\u2019s systems or employee laptops. A malicious actor used access to Cursor\u2019s marketplace to publish a tampered copy of the Claude Code extension, which we didn\u2019t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.","title":null,"type":"comment","url":null},{"author":"acedTrex","children":[{"author":"goingbananas","children":[],"created_at":"2026-10-30T19:03:39.000Z","created_at_i":1793387019,"id":50308667,"options":[],"parent_id":50304254,"points":null,"story_id":50300683,"text":"I chuckled at this, thanks","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:16:49.000Z","created_at_i":1793369809,"id":50304254,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Thankfully coding is solved everyone","title":null,"type":"comment","url":null},{"author":"shahbaby","children":[],"created_at":"2026-10-30T14:18:00.000Z","created_at_i":1793369880,"id":50304272,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"I think right now AI is helping the attackers more than it's helping the defenders.
That part is probably obvious.
But in the long term, I suspect this will get worse.
Attackers will still need to think critically to be a few steps ahead of the defenders.
But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.","title":null,"type":"comment","url":null},{"author":"felixrieseberg","children":[{"author":"cryptonym","children":[{"author":"Handy-Man","children":[{"author":"cryptonym","children":[],"created_at":"2026-10-30T15:43:36.000Z","created_at_i":1793375016,"id":50305553,"options":[],"parent_id":50304736,"points":null,"story_id":50300683,"text":"Let's say Anthropic has been impersonated and they are not at fault. I'd expect Cursor to provide information to them about this, and Anthropic being able to comment.
Btw, if you got any insights, you are more than welcome to share.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:47:39.000Z","created_at_i":1793371659,"id":50304736,"options":[],"parent_id":50304659,"points":null,"story_id":50300683,"text":"Ask Cursor team?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:42:33.000Z","created_at_i":1793371353,"id":50304659,"options":[],"parent_id":50304538,"points":null,"story_id":50300683,"text":"> A malicious actor used access to Cursor\u2019s marketplace
How did they get access to this?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T14:35:56.000Z","created_at_i":1793370956,"id":50304538,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Felix from Anthropic here.
We\u2019re working with Cursor on this incident, but it wasn\u2019t a compromise of Anthropic\u2019s systems or employee laptops. A malicious actor used access to Cursor\u2019s marketplace to publish a tampered copy of the Claude Code extension, which we didn\u2019t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.","title":null,"type":"comment","url":null},{"author":"ihuman","children":[],"created_at":"2026-10-30T14:37:37.000Z","created_at_i":1793371057,"id":50304570,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"This is just the version of extension on the Cursor marketplace, not the one on the VS Code marketplace, right?","title":null,"type":"comment","url":null},{"author":"kiproping","children":[],"created_at":"2026-10-30T14:43:43.000Z","created_at_i":1793371423,"id":50304676,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"More details from Kevin Beaumont. "Anthropic got compromised. Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops. " https://cyberplace.social/@GossiTheDog/117528831681803563","title":null,"type":"comment","url":null},{"author":"Glyptodon","children":[],"created_at":"2026-10-30T14:50:30.000Z","created_at_i":1793371830,"id":50304785,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Normal VS code doesn't even use Cursor Marketplace, right? The way this is reported lacks clarity. Do people using plain CS Code even use the Cursor Marketplace? Or am I missing something?","title":null,"type":"comment","url":null},{"author":"rhedak","children":[],"created_at":"2026-10-30T15:01:58.000Z","created_at_i":1793372518,"id":50304896,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Honestly with AI getting smarter it feels like these kind of attacks will only increase...","title":null,"type":"comment","url":null},{"author":"vanbashan","children":[],"created_at":"2026-10-30T15:05:24.000Z","created_at_i":1793372724,"id":50304949,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Is it related to today binance event?","title":null,"type":"comment","url":null},{"author":"paxy","children":[{"author":"Aboutplants","children":[],"created_at":"2026-10-30T15:29:09.000Z","created_at_i":1793374149,"id":50305310,"options":[],"parent_id":50305107,"points":null,"story_id":50300683,"text":"Yup","title":null,"type":"comment","url":null},{"author":"arm32","children":[],"created_at":"2026-10-30T21:01:31.000Z","created_at_i":1793394091,"id":50310086,"options":[],"parent_id":50305107,"points":null,"story_id":50300683,"text":"A beautiful thing","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T15:15:53.000Z","created_at_i":1793373353,"id":50305107,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"So let me get this straight \u2013 Elon was trolling Binance on Twitter, when in fact it was his own company that got hacked and led to the theft?","title":null,"type":"comment","url":null},{"author":"ricky_risky","children":[],"created_at":"2026-10-30T15:20:31.000Z","created_at_i":1793373631,"id":50305175,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"not just anthropic, my product that used antigravity is also leaked and copied by google, these close ai company will undoubtably steal your code, file and data.
strongly suggest put your valuable work on local llm.","title":null,"type":"comment","url":null},{"author":"hemlock4593","children":[],"created_at":"2026-10-30T15:29:52.000Z","created_at_i":1793374192,"id":50305325,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"It's funny that's the point where people draw the line. But that basically every API based agent is doing RCE where commands are fetched from servers is perfectly fine.","title":null,"type":"comment","url":null},{"author":"hughw","children":[],"created_at":"2026-10-30T15:35:05.000Z","created_at_i":1793374505,"id":50305412,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Idea: why don't all the various app stores and plugin repos use LLMs to review all submissions for security? Certainly in the human powered age that was too big a task to take on, but now it seems doable.","title":null,"type":"comment","url":null},{"author":"rietta","children":[],"created_at":"2026-10-30T15:41:30.000Z","created_at_i":1793374890,"id":50305522,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Do publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?","title":null,"type":"comment","url":null},{"author":"nunez","children":[],"created_at":"2026-10-30T15:53:41.000Z","created_at_i":1793375621,"id":50305723,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Kind of surprised that Cursor doesn't do checksum verification for plugins. That would have stopped this completely. (Unless it does and this backdoor is more theoretical than anything else.)","title":null,"type":"comment","url":null},{"author":"jonas21","children":[],"created_at":"2026-10-30T16:31:23.000Z","created_at_i":1793377883,"id":50306306,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"This is from the Cursor blog [1] linked in the description, but repeating it here in case it's useful to anyone:
------
Check whether you are impacted
The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:
On macOS, run:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"\n $files = "$HOME\\.ssh\\authorized_keys", "C:\\ProgramData\\ssh\\administrators_authorized_keys" | Where-Object { Test-Path $_ }\n if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }\n[1] https://cursor.com/blog/claude-code-extension-security-notic...","title":null,"type":"comment","url":null},{"author":"cookiengineer","children":[],"created_at":"2026-10-30T16:55:26.000Z","created_at_i":1793379326,"id":50306693,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"It's dangerous to go alone, take this [1]
[1] https://github.com/cookiengineer/check-claude-code-exfil","title":null,"type":"comment","url":null},{"author":"gokuljs","children":[{"author":"Aboutplants","children":[],"created_at":"2026-10-30T17:15:30.000Z","created_at_i":1793380530,"id":50307006,"options":[],"parent_id":50306973,"points":null,"story_id":50300683,"text":"Curser is owned by SpaceX, who\u2019s leader also owns Twitter. It\u2019s bad for business to publicize your own company\u2019s errors so they are suppressing it","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T17:13:19.000Z","created_at_i":1793380399,"id":50306973,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Why is this not trending on Twitter","title":null,"type":"comment","url":null},{"author":"jehnnysmith","children":[],"created_at":"2026-10-30T18:15:42.000Z","created_at_i":1793384142,"id":50307990,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Just uninstalled all the vscode extensions. Dont need any of them anymore.","title":null,"type":"comment","url":null},{"author":"pentamassiv","children":[],"created_at":"2026-10-30T18:53:28.000Z","created_at_i":1793386408,"id":50308518,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"You can set a cooldown for Cursor extensions
1. Open Cursor.
2. Press Ctrl + Shift + P.
3. Search for Preferences: Open User Settings (JSON).
4. Add:
{
"extensions.installCooldownHours": 72\n\n}It's lucky that management doesn't want a 10x increase in output after laying off half the staff so we have a lot of time to vet deps! Oh no...","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T19:57:27.000Z","created_at_i":1793390247,"id":50309339,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"This kind of thing is only going to get worse. People assume other devs are "like them" but state actors (think US, NK, RS, CN) are likely using AI at this point to run agents non-stop to break security by making dev tools or contributing to open source. Keep in mind that open source is the backbone of nearly all software being used - we're in for a rough ride if we don't treat all new things coming in as if they are potentially a nuclear bomb masquerading as a trojan horse.","title":null,"type":"comment","url":null},{"author":"madarao","children":[{"author":"gpm","children":[],"created_at":"2026-10-30T20:02:01.000Z","created_at_i":1793390521,"id":50309389,"options":[],"parent_id":50309358,"points":null,"story_id":50300683,"text":"No.
Well probably yes but not at all relevant here... the problem wasn't the legitimate extension, it was cursor serving a fake malware one.","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T19:58:53.000Z","created_at_i":1793390333,"id":50309358,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Let me guess, they vibe coded their vibe coding extension?","title":null,"type":"comment","url":null},{"author":"spdustin","children":[],"created_at":"2026-10-30T20:19:05.000Z","created_at_i":1793391545,"id":50309587,"options":[],"parent_id":50300683,"points":null,"story_id":50300683,"text":"Cursor's "marketplace proxy" is, by definition, an MitM of Open VSX. Why on earth is that trustworthy to its users? Is it some mashup of Open VSX Connect and an API endpoint that merges their private marketplace with the public one? And what's so special about Cursor's CC extension implementation that they couldn't just serve the "real" one?
Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?","title":null,"type":"comment","url":null}],"created_at":"2026-10-30T07:09:12.000Z","created_at_i":1793344152,"id":50300683,"options":[],"parent_id":null,"points":689,"story_id":50300683,"text":"https://cursor.com/blog/claude-code-extension-security-notic...","title":"Backdoor in Claude Code for VS Code extension on the Cursor Marketplace","type":"story","url":"https://phorion.io/blog/offical-claude-code-vsx-compromise/"}