YHK - yet another hacker news clone

Anthropic hacked to deliver remote access trojan

261 points bashtoni 2 hours ago 49 comments

richrichardsson 2 hours ago | parent

How legit is this? Seems low on details.

I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?

abirch 2 hours ago | parent

1shooner posted this link: https://www.binance.com/en/square/post/10-30-2026-claude-cod... this was not the official extension. Supply Chain is very important, please only use official builds. From the link above:

A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.

hoppp 21 minutes ago | parent

Better be safe and check your dev environment if you use it.

1shooner 2 hours ago | parent

Cursor reporting this: https://cursor.com/blog/claude-code-extension-security-notic...

What appears to be an official Binance account reporting it also:

https://www.binance.com/en/square/post/10-30-2026-claude-cod...

rolosa 2 hours ago | parent

He says to follow his social, and he provides his handle, but there's no link, and I have no idea how to read it.

episodeiv 2 hours ago | parent

You can see his posts at https://cyberplace.social/@GossiTheDog/

rolosa 1 hour ago | parent

Eh, he's already lost me the moment he made it difficult.

fn-mote 1 hour ago | parent

If you don’t have anything to steal, you don’t need to follow a security researcher anyway.

/s

henearkr 2 hours ago | parent

It wasn't Anthropic that was hacked but SpaceXAI (their Cursor Marketplace).

darkwi11ow 1 hour ago | parent

Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.

I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.

edit:

Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...

  The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.

tyingq 1 hour ago | parent

Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.

AdrianCX 1 hour ago | parent

Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...

This could have been avoided by having extensions signed by company doing them with keys and review

darkwi11ow 59 minutes ago | parent

Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim their proprietary VSCode marketplace to be more secure.

AdrianCX 53 minutes ago | parent

Then why even allow employees to use that?

Binance got a pretty expensive lesson if that was the cause for their recent hack

darkwi11ow 41 minutes ago | parent

There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.

AdrianCX 22 minutes ago | parent

Why not use claude code directly?

Why risk getting compromised like that?

darkwi11ow 8 minutes ago | parent

Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use Claude, Codex and Cursor/SpaceX agents, and Cursor comes very convenient to have all three in a single interface. Also I still code manually especially when prototyping, so having an IDE helps with it as well. I knew about OpenVSX situation with the search, so when installing extensions I always did triple-checking to verify the extension being really submitted by upstream and not by squatter; but now given upgrades can also deliver a compromise I am thinking of developing an extension that will act in similar manner to pnpm minimum release age.

K0nserv 1 hour ago | parent

Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.

Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.

0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...

1: https://github.com/anthropics/claude-code/releases/tag/v2.1....

2: https://github.com/anthropics/claude-code/releases/tag/v2.1....

3: https://github.com/anthropics/claude-code/releases/tag/v2.1....

no-name-here 1 hour ago | parent

You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.

Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?

K0nserv 11 minutes ago | parent

You make a good point, my comment above probably overstates things.

mirashii 2 minutes ago | parent

There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.

Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...

glimshe 1 hour ago | parent

Why didn't Claude detect the hack and prevent it from affecting customers using its superhuman AGI reasoning?

_heimdall 1 hour ago | parent

Don't worry, I assume an LLM version of McAfee Total Protection Antivirus is coming soon

nannal 50 minutes ago | parent

I do have a log reading / action / resolution product in the works.

Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.

Also works with local models well enough.

Geezus_42 41 minutes ago | parent

I've set up something like that with a small local model in my homelab.

Filligree 12 minutes ago | parent

I’ve set up something like that with Opus. Works well enough, and points out CVEs to fix on the regular.

Running NixOS helps.

jmbwell 7 minutes ago | parent

I love how LLMs have brought DIY software back. Need an app? Just make it. Like back when you’d write programs in BASIC

eviks 1 hour ago | parent

It was safety-contrained from being able to realize its full potential.

MisterTea 46 minutes ago | parent

They weren't using last minutes model, which is totally better than last hours model which would have totally detected this, pinkie swear.

Hackbraten 34 minutes ago | parent

You’re absolutely correct, and I owe you a honest statement—it was a hack, and here’s the kicker: *I failed to catch it, and that’s on me.*

Here’s a complete rundown of what happened—load-bearing parts first:

K0nserv 1 hour ago | parent

If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.

cube00 1 hour ago | parent

Even if you don't have cryptocurrency they can still go after your GitHub credentials and run some very expensive agent and runner workloads.

I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.

K0nserv 1 hour ago | parent

For sure sandboxing and isolation is feeling increasingly relevant regardless, but crypto theft is acting as a good sponge.

bakies 41 minutes ago | parent

That's why I stay away from that dumpster fire too!

DonHopkins 25 minutes ago | parent

Every dumpster fire has a silver lining when people who deserve it get burned.

helsinkiandrew 1 hour ago | parent

> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor

That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:

> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace

https://cursor.com/blog/claude-code-extension-security-notic...

darkwi11ow 1 hour ago | parent

Nah it was Anthropic, see my comment at https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi...

Cursor does a bad reporting branding OpenVSX as "Cursor Marketplace". What a joke the company had become under Elon. But also it might be related to Anthropic/SpaceX business ties, they try to minimize damage on Anthropic pre-IPO

swingboy 1 hour ago | parent

Wasn’t it called Cursor Marketplace pre-Elon?

darkwi11ow 1 hour ago | parent

Cursor always used OpenVSX for VSCode extensions. There is separate "Cursor Marketplace" (https://cursor.com/marketplace) but it installs "Cursor Plugins" which are exclusively Cursor feature not related to VSCode, and Anthropic had never released a "Cursor Plugin"

psychoslave 1 hour ago | parent

It's part of the plan to make you believe it is not as performant as what their flesh puppets pretend it to be. All these people in AI companies shown all the time on the web, did you ever met one?

The matrix has you Andrew.

I know, I should have launched a career in conspirationism.

nickphx 1 hour ago | parent

lol clueless clowns.. when will people learn?

jedisct1 1 hour ago | parent

Keep sending all your secrets and giving full control of your devices to Anthropic.

This is fine.

VoidWhisperer 1 hour ago | parent

My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless

gcr 38 minutes ago | parent

Kevin Beaumont says the extension for “VSCode and Cursor” was compromised: https://cyberplace.social/@GossiTheDog/117528831681803563

xteam 46 minutes ago | parent

♟

xteam 46 minutes ago | parent

Lmao,must be a sad day

reilly3000 23 minutes ago | parent

My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.

paxy 3 minutes ago | parent

Is there any proof of this or are we just upvoting garbage?