I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
You could also look into user gVisor runtime for extra security.
If not, then I think you're right about full VM.
I've been eyeing Gondolin for a while for that, but haven't yet tried it.
/s
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
edit:
Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...
The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.This could have been avoided by having extensions signed by company doing them with keys and review
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
[1]: https://code.visualstudio.com/api/working-with-extensions/pu...
1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)
2. The Visual Studio marketplace, hard-wired into VS Code
3. Open VSX
If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.
Edit: Cursor is apparently stating now that the tampered files were only on their mirror not OpenVSX.
I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.
Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.
It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.
Running NixOS helps.
Hats off to the hackers.
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under Elon. But also it might be related to Anthropic/SpaceX business ties, they try to minimize damage on Anthropic pre-IPO
Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?
The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.
This is fine.
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
An official announcement from Anthropic would be nice!
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.
Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.
You can try not installing malware like Claude Code or, if you absolutely must, doing it in a sandbox.
A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
I run it in an ephemeral container which has access to the current working directory and it drastically limits the attack radius.
That part is probably obvious.
But in the long term, I suspect this will get worse.
Attackers will still need to think critically to be a few steps ahead of the defenders.
But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
How did they get access to this?
Binance got a pretty expensive lesson if that was the cause for their recent hack
Why risk getting compromised like that?
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.
Edit: It seems Cursor is claiming the tampered files were only in their mirror.
Vibecoders are safu
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you
Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.
0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...
1: https://github.com/anthropics/claude-code/releases/tag/v2.1....
2: https://github.com/anthropics/claude-code/releases/tag/v2.1....
3: https://github.com/anthropics/claude-code/releases/tag/v2.1....
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.
This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.
https://github.com/jeanp413/open-remote-ssh
and run vscode-server inside a VM or container
I only have a single "Local Extension" and it is open-remote-ssh itself.
Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.
When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.
It tells you all you need to know about how unserious these people are about computer security.
Or, is this FUD?
> I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models.
> The open challenge is how to prove it!
Prominent Anthropic employees keep claiming to have solved prompt injection [2] and quickly get proved wrong [3]. They've burned my goodwill on this front.
[1] https://www.reddit.com/r/ClaudeCode/comments/1xhqvzn/opus_55...
[2] https://x.com/bcherny/status/2086520950259118464
[3] https://embracethered.com/blog/posts/2026/breaking-claude-co...
How could Anthropic have known, they only claim to harbour superintelligence.
/s
It may be the cause, but zero excuse.
It also sounds like only cursor marketplace is affected, not vscode proper.
It’s good fun building for retro-like machines.
Sums up my feelings of the last few years nicely.
(This is a joke, to be clear.)
Good that you said so, this is annoyingly plausible.
Here’s a complete rundown of what happened—load-bearing parts first:
> No review system at anthropic has seen this
Weird flex
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future.
Not sure they'd share your views on using Claude for security policy/coverage being silly.
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.
At a minimum they should monitor the larger marketplaces even if they're not in the chain.
Also worth noting that it doesn’t use Open VSX directly but uses a cursor hosted mirror at https://marketplace.cursorapi.com/open-vsx-mirror
> but it is unclear whether his account or another part of the publishing process was compromised.
God, people get so conspiratorial on HN when it comes to Ant
The Binance post should probably be the root link for this topic not this blog post - IMO
[0] https://www.binance.com/en/square/post/10-30-2026-claude-cod...
We probably transfered more code/codebases and company secrets to random endpoints than ever before.
Btw. you could setup a sandbox and limit access
You always do that, right? ...right?
So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.
curl > some_file
bash some_file
Edit: thanks for the replies, that makes perfect sense
Yeah I sympathize with people saying software developers should not be called engineers too.
I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.
``` host claudebox hostname 192.168.122.105 user developer IdentityFile ~/.ssh/id_rsa ```
``` host codexbox hostname 192.168.122.106 user developer IdentityFile ~/.ssh/id_rsa ```
I drop only my public key inside the VM. Then I set up the ~/Projects folder with the code the bot is working on any any authorized samples.
Then in my local on my host clone of the repository, I add another remote like
``` git remote add codexbox ssh://codexbox/home/developer/Projects/hello-world ```
Then git push codexbox.
Then I just SSH in or use the vm gui and interact with the agent there. I like to keep it running in byobu so I can remote in more easily when I am on the laptop out and about.
I think you’re giving Musk too much credit.
SpaceX will be re-valued on Anthropic's, or OpenAI's success, he, and his people are smart enough to understand this.
SpaceX obviously has multiple sources of income, not just data center rents
Your conspiracy theory needs some work.
So really, there's no way to say what was compromised and where.
This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed
So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.
I didn’t need any more evidence. The media is fake and everything you see is designed to affect the stock price somewhere and if it can’t affect the stock price, you don’t see it.
But holy shit, they’re asking me if I saw the “rogue agents”.
Trillions of dollars are involved here to swing clueless people into being scared and also awed. It’s gross.
Looks good to me...
Nobody knows ... what any of it means... sing
[1] https://m.youtube.com/watch?v=3TNpOD6bov8
In all seriousness, there is nobody at Anthropic who can even give you that answer, because nobody there reads their pushed code anymore. Take a look at the previous Claude Code leaked codebases if you don't believe me, there is hundreds of files with 1000+ or more import statements at the top.
Any human would immediately tell you that it needs to be refactored from scratch. Their codebase also leaked that they're using review bots automatically instead of a human-in-the-loop review process.
IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.
Ai summary in better words: The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.
Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
Seems a bit early to say.
> A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.
For a pretty limited definition of "we" true and obvious. For the interesting definition of "we", proven through the access, not true.
> The versions on our official channels are not affected and this only impacts Cursor users.
A responsible vendor would have considered the Cursor (OpenVSX) extension an official channel. The extension hosted there even has Anthropic copyright notices and Anthropic terms of use. Pretty ridiculous an extension on a channel with 63 million downloads is not official.
As discussed here:
https://cyberplace.social/@GossiTheDog/117528831681803563
and as can be seen as there is no version 2.1.313 here: https://open-vsx.org/extension/Anthropic/claude-code/2.1.313
but there is https://open-vsx.org/extension/Anthropic/claude-code/2.1.314 https://open-vsx.org/extension/Anthropic/claude-code/2.1.312
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
mindracer•6h ago