> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What
a joke the company had become under Elon. But also it might be related to
Anthropic/SpaceX business ties, they try to minimize damage on Anthropic
pre-IPO
Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and Anthropic had never released a "Cursor Plugin"
It's part of the plan to make you believe it is not as performant as what their flesh puppets pretend it to be. All these people in AI companies shown all the time on the web, did you ever met one?
The matrix has you Andrew.
I know, I should have launched a career in conspirationism.
This is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize
(official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX
account with release privileges.
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.
Yeah OpenVSX security is a joke, they also have dumb search algorithm which
allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim
their proprietary VSCode marketplace to be more secure.
There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no
good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.
Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use Claude, Codex and Cursor/SpaceX agents, and Cursor comes very convenient to have all three in a single interface. Also I still code manually especially when prototyping, so having an IDE helps with it as well. I knew about OpenVSX situation with the search, so when installing extensions I always did triple-checking to verify the extension being really submitted by upstream and not by squatter; but now given upgrades can also deliver a compromise I am thinking of developing an extension that will act in similar manner to pnpm minimum release age.
Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.
My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless
If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under Elon. But also it might be related to Anthropic/SpaceX business ties, they try to minimize damage on Anthropic pre-IPO
The matrix has you Andrew.
I know, I should have launched a career in conspirationism.
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.
Running NixOS helps.
Sums up my feelings of the last few years nicely.
Here’s a complete rundown of what happened—load-bearing parts first:
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
This could have been avoided by having extensions signed by company doing them with keys and review
Binance got a pretty expensive lesson if that was the cause for their recent hack
Why risk getting compromised like that?
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
/s
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
This is fine.