Yet another Hacker News

Anthropic hacked to deliver remote access trojan

215 points bashtoni 2 hours ago 37 comments

richrichardsson 2 hours ago | parent

How legit is this? Seems low on details.

I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?

abirch 1 hour ago | parent

1shooner posted this link: https://www.binance.com/en/square/post/10-30-2026-claude-cod... this was not the official extension. Supply Chain is very important, please only use official builds. From the link above:

A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.

1shooner 1 hour ago | parent

Cursor reporting this: https://cursor.com/blog/claude-code-extension-security-notic...

What appears to be an official Binance account reporting it also:

https://www.binance.com/en/square/post/10-30-2026-claude-cod...

rolosa 1 hour ago | parent

He says to follow his social, and he provides his handle, but there's no link, and I have no idea how to read it.

episodeiv 1 hour ago | parent

You can see his posts at https://cyberplace.social/@GossiTheDog/

rolosa 1 hour ago | parent

Eh, he's already lost me the moment he made it difficult.

fn-mote 1 hour ago | parent

If you don’t have anything to steal, you don’t need to follow a security researcher anyway.

henearkr 1 hour ago | parent

It wasn't Anthropic that was hacked but SpaceXAI (their Cursor Marketplace).

darkwi11ow 1 hour ago | parent

Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.

I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.

edit:

Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...

  The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.

tyingq 1 hour ago | parent

Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.

AdrianCX 32 minutes ago | parent

Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...

This could have been avoided by having extensions signed by company doing them with keys and review

darkwi11ow 29 minutes ago | parent

Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim their proprietary VSCode marketplace to be more secure.

AdrianCX 23 minutes ago | parent

Then why even allow employees to use that?

Binance got a pretty expensive lesson if that was the cause for their recent hack

darkwi11ow 11 minutes ago | parent

There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.

K0nserv 1 hour ago | parent

Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.

Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.

0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...

1: https://github.com/anthropics/claude-code/releases/tag/v2.1....

2: https://github.com/anthropics/claude-code/releases/tag/v2.1....

3: https://github.com/anthropics/claude-code/releases/tag/v2.1....

no-name-here 40 minutes ago | parent

You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.

Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?

glimshe 1 hour ago | parent

Why didn't Claude detect the hack and prevent it from affecting customers using its superhuman AGI reasoning?

_heimdall 1 hour ago | parent

Don't worry, I assume an LLM version of McAfee Total Protection Antivirus is coming soon

nannal 20 minutes ago | parent

I do have a log reading / action / resolution product in the works.

Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.

Also works with local models well enough.

Geezus_42 11 minutes ago | parent

I've set up something like that with a small local model in my homelab.

eviks 1 hour ago | parent

It was safety-contrained from being able to realize its full potential.

MisterTea 15 minutes ago | parent

They weren't using last minutes model, which is totally better than last hours model which would have totally detected this, pinkie swear.

K0nserv 1 hour ago | parent

If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.

cube00 45 minutes ago | parent

Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.

I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.

K0nserv 40 minutes ago | parent

For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.

bakies 10 minutes ago | parent

That's why I stay away from that dumpster fire too!

helsinkiandrew 54 minutes ago | parent

> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor

That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:

> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace

https://cursor.com/blog/claude-code-extension-security-notic...

darkwi11ow 43 minutes ago | parent

Nah it was Anthropic, see my comment at https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi...

Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under Elon. But also it might be related to Anthropic/SpaceX business ties, they try to minimize damage on Anthropic pre-IPO

swingboy 37 minutes ago | parent

Wasn’t it called Cursor Marketplace pre-Elon?

darkwi11ow 35 minutes ago | parent

Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and Anthropic had never released a "Cursor Plugin"

psychoslave 38 minutes ago | parent

It's part of the plan to make you believe it is not as performant as what their flesh puppets pretend it to be. All these people in AI companies shown all the time on the web, did you ever met one?

The matrix has you Andrew.

I know, I should have launched a career in conspirationism.

nickphx 39 minutes ago | parent

lol clueless clowns.. when will people learn?

jedisct1 31 minutes ago | parent

Keep sending all your secrets and giving full control of your devices to Anthropic.

This is fine.

VoidWhisperer 30 minutes ago | parent

My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless

gcr 8 minutes ago | parent

Kevin Beaumont says the extension for “VSCode and Cursor” was compromised: https://cyberplace.social/@GossiTheDog/117528831681803563

xteam 16 minutes ago | parent

♟

xteam 15 minutes ago | parent

Lmao,must be a sad day