^^ Had to verify that this was a real quote from the chain and not a joke. It is accurate.

Do you have any sources? OP claims that it *also* affects Open VSX

You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.

This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.

The screenshot is of the official marketplace

Emphasis on guessing. If/when there is an actual postmortem, you’ll know when the back door was introduced.

You are either lucky or compromised.

Not updating air gapped systems is a security feature, not a bug.

I think VS Code extensions autoupdate by default, unless you disable it.

Looks like a solid response with instructions and scripts how to get rid of the infection, but it doesn’t explain how it got there.

Yet, they managed to screw up.

Don't worry, it isn't, just a regular Anti-AI clickbait post. A fake Claude Code extension was available on Cursor (not VSCode regular). Uploaded by someone that wasn't Anthropic. 5k Cursor users affected.

5,000*

This was a compromise of the extension. The same kind of supply-chain attack could happen to literally any extension, package or other piece of software you install. Not excusing Anthropic letting this happen, but it doesn't have any bearing on the security and privacy of using Claude Code or Codex. Yes, you need to be careful about what they do. The fact that you might still get pwned via some other vector is irrelevant.

There’s a reason codex and the like improved like they did. You can simply look. Or hear about it on podcasts.

In at least one case they were! https://cybernews.com/ai-news/grok-build-git-repository-uplo...

Don't forget: To make LLM useful you give it EVERYTHING it needs to know to be useful and if you don't use a certain provider with proper legal status, this is just gone.

We probably transfered more code/codebases and company secrets to random endpoints than ever before.

Btw. you could setup a sandbox and limit access

Isn't it fun when all the lines are blurred and it hard to tell what belongs where?

It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)

VS Code doesn't allow forks to use their marketplace, I think. At least with VSCodium, they don't. I think they even patch a workaround where you could download almost all extensions' .vsix files.

This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.