Yet another Hacker News

Backdoors in official Claude Code extensions

409 points dsr_ 2 hours ago 119 comments

hem777 1 hour ago | parent

”I've confirmed Binance use Claude Code with this extension.”

fn-mote 1 hour ago | parent

^^ Had to verify that this was a real quote from the chain and not a joke. It is accurate.

xx_ns 1 hour ago | parent

I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.

EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.

EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:

> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.

[1]: https://code.visualstudio.com/api/working-with-extensions/pu...

thevinter 1 hour ago | parent

Do you have any sources? OP claims that it *also* affects Open VSX

Hackbraten 44 minutes ago | parent

Three different marketplaces have been mentioned in this discussion:

1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)

2. The Visual Studio marketplace, hard-wired into VS Code

3. Open VSX

If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.

xx_ns 44 minutes ago | parent

I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.

tveita 40 minutes ago | parent

But the report OP cites at https://phorion.io/blog/offical-claude-code-vsx-compromise/ doesn't make a claim about Visual Studio Marketplace, only "the official Claude Code for VS Code extension bundle on the Cursor Marketplace"

mrweasel 1 hour ago | parent

You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.

This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.

eviks 1 hour ago | parent

What would be the careful way of installing the official extension?

mrweasel 1 hour ago | parent

That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.

toyg 48 minutes ago | parent

> You could download the extension, diff it against the previous version and read all the code.

This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.

jeromechoo 11 minutes ago | parent

The CTA flavor of the year for dev tools is cURLing some arbitrary install script and run it immediately which always sounded ridiculous to me. If instead that script first pipes into claude -p for a basic vulnerability scan before continuing, I would be delighted.

DanielHB 27 minutes ago | parent

I recommend moving to VSCodium and using this extension:

https://github.com/jeanp413/open-remote-ssh

and run vscode-server inside a VM or container

mrweasel 7 minutes ago | parent

Would that really help, if you install the extension it's running in the VSCodium instance on your machine... or is it running in the vscode-server?

misnome 1 hour ago | parent

The screenshot is of the official marketplace

nubinetwork 1 hour ago | parent

It looks like they push an update every office day. I'm guessing if I installed 6 months ago and didn't update, that I should be fine?

fn-mote 1 hour ago | parent

Emphasis on guessing. If/when there is an actual postmortem, you’ll know when the back door was introduced.

fg137 1 hour ago | parent

You are either lucky or compromised.

koolba 1 hour ago | parent

Not updating air gapped systems is a security feature, not a bug.

staminade 1 hour ago | parent

I think VS Code extensions autoupdate by default, unless you disable it.

entrope 1 hour ago | parent

Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.

I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.

Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.

altbdoor 1 hour ago | parent

Cursor has released a security notice:

https://cursor.com/blog/claude-code-extension-security-notic...

sharpshadow 1 hour ago | parent

Looks like a solid response with instructions and scripts how to get rid of the infection, but it doesn’t explain how it got there.

yubblegum 1 hour ago | parent

> Cursor: "This malicious version of the extension was not developed by Anthropic."

Wtf does that mean.

sourcecodeplz 58 minutes ago | parent

someone got access to the account that can publish extension on cursor marketplace?

noitpmeder 58 minutes ago | parent

Just by people they paid to represent them.

olmo23 51 minutes ago | parent

It sounds to me like they're saying it wasn't an Anthropic employee which decided to drop an SSH backdoor.

LastTrain 13 minutes ago | parent

Well that is even worse...

stingraycharles 19 minutes ago | parent

It means that Anthropic did not intentionally develop a malicious version, obviously. But it’s a bit disingenuous and tries to suggest that it wasn’t Anthropic that uploaded it and/or wasn’t published under Anthropic’s name, which isn’t true.

mirashii 18 minutes ago | parent

Given they mentioned taking down and rebuilding the marketplace registry in that post, it seems equally likely that Cursor’s infrastructure was the source of the intrusion and a folks are jumping the gun on attribution.

LastTrain 14 minutes ago | parent

It means we are from now on in an era of plausible deniability.

bunderbunder 14 minutes ago | parent

I would guess it’s supposed to communicate a few things. One big one is, ”Our AI software factory didn’t do it. Don’t worry, letting Claude spin away with limited human supervision is still safe.”

internet_points 3 minutes ago | parent

we got hacked by someone other than ourselves this time

eviks 1 hour ago | parent

That's literally impossible, with all the access to the frontier software development tools at their disposal they can ship features securely at 100x

kamban 1 hour ago | parent

Yet, they managed to screw up.

iugtmkbdfil834 1 hour ago | parent

:D I have to assume parent is being a little sarcastic.

It obviously doesn't take much to simply add 'just one more feature' that happens to undermine the original purpose of the application.

skydhash 1 hour ago | parent

It always about “we solved the bottleneck in coding”. But the slowness was not about typing, or finding docs. It’s always about ensuring screwups don’t happen.

mirekrusin 35 minutes ago | parent

To be fair it’s not like screwups were not happening before, but if you move 100x faster and are 50x more secure than before you’re still 2x more exposed.

atrokhymchuk 1 hour ago | parent

I am afraid until 200x is achieved we are at risk...

btown 57 minutes ago | parent

Only with two fully maxed subscriptions can we achieve this, and this is forbiddeneded

samiv 54 minutes ago | parent

Just put gastown on it!

stymaar 51 minutes ago | parent

I read a few month ago a comment from an Anthropic or OpenAI employee saying that the security problem of prompt injection was a solved problem at this point, as the frontier models where rejecting 98% of attacks.

It tells you all you need to know about how unserious these people are about computer security.

malfist 50 minutes ago | parent

I'm glad no one can steal from my bank, they stop 98% of thieves

prologic 2 minutes ago | parent

Hey! It's at least 1 9's right? That's better than zero 9's LOL

tiahura 2 minutes ago | parent

Can you link to a list of this year’s top prompt injection hacks of frontier models?

Or, is this FUD?

Cthulhu_ 21 minutes ago | parent

On the other hand, they don't know what their models do or can do and nothing is safe ever, so ???

thatsabadlook 16 minutes ago | parent

Anthropic: coding is solved Also anthropic: we ship actual malware to customers.

dgellow 2 minutes ago | parent

I get the snark but to be fair, the company has been growing like crazy. That makes it really hard to keep track of everything happening when you grow your team by 5x over a relatively short period of time

stopsayingsorry 1 hour ago | parent

Imagine backdooring 50+ million installs.

Hats off to the hackers.

stbenjam 1 hour ago | parent

5,000*

gcoakes 1 hour ago | parent

I think that's just the number Cursor has telemetry on. I think there's multiple distribution locations.

misnome 1 hour ago | parent

5000 is the cursor number for people on the cursor version of the store, not the VSCode store.

misnome 1 hour ago | parent

Has anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and

> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.

anon-3988 1 hour ago | parent

I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?

staminade 1 hour ago | parent

This was a compromise of the extension. The same kind of supply-chain attack could happen to literally any extension, package or other piece of software you install. Not excusing Anthropic letting this happen, but it doesn't have any bearing on the security and privacy of using Claude Code or Codex. Yes, you need to be careful about what they do. The fact that you might still get pwned via some other vector is irrelevant.

minraws 58 minutes ago | parent

Can't their millions of agent swarms detect a malicious supply chain vector, sure it can happen to any company but not the one people are literally handing over their entire companies too.

Anthropic holds the SLA/MSA agreements not this bad actors what happens to your data is unknown if these become frequent and accepted. Given how much data is piped to Claude code via these services/extensions.

Den_VR 1 hour ago | parent

There’s a reason codex and the like improved like they did. You can simply look. Or hear about it on podcasts.

snaking0776 1 hour ago | parent

In at least one case they were! https://cybernews.com/ai-news/grok-build-git-repository-uplo...

origini 1 hour ago | parent

Don't forget: To make LLM useful you give it EVERYTHING it needs to know to be useful and if you don't use a certain provider with proper legal status, this is just gone.

We probably transfered more code/codebases and company secrets to random endpoints than ever before.

Btw. you could setup a sandbox and limit access

raxxorraxor 48 minutes ago | parent

Both is completely secure theoretically. You can read the output of the curl before you refetch and pipe it to bash. You can also look at the commands claude is executing.

You always do that, right? ...right?

deadbabe 43 minutes ago | parent

No but we use MCP so we’re fine.

novafunc 33 minutes ago | parent

I used to think the same, but apparently there's a way to differentiate between curling into bash and curling into a text file.

So you could be diligent and curl into a text file, see nothing is wrong, but then when you curl into bash, it runs something different.

wolttam 6 minutes ago | parent

    curl > some_file
    bash some_file

(Also, how in the world would a server be able to tell where you’re piping the response?)

magnio 46 minutes ago | parent

> Who's checking?

Yeah I sympathize with people saying software developers should not be called engineers too.

palata 40 minutes ago | parent

I think that software engineering is very much engineering.

I just think that the level of malpractice in software engineering is a lot higher than in other engineering fields, for some reasons.

knottn 16 minutes ago | parent

Maybe it’s easier to outsource.

darkwi11ow 24 minutes ago | parent

I only use agentic development tools in qemu VM that has no production access or host shared folders, and the only secrets there are development. I still have my Git ssh key there, but I never use ssh agent to load the keys. The worst that agentic tools can do to me, is to install keylogger and compromise my ssh key and password, but even then my deployment workflow includes creating release in Github, which is not possible via ssh key only. I was very lucky to avoid the hack yesterday, as I use Claude installed via OpenVSX, but even if I installed the compromised version, the damage would be minimal.

hangrybear666 11 minutes ago | parent

Hell yeah that's the most sane and efficient personal dev sandboxing work flow I've heard and shows you know your stuff. Just basics but executed very well.

AdrianCX 1 hour ago | parent

https://www.reuters.com/business/media-telecom/cursor-says-u...

> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday

So is this or isn't this from Anthropic and how did this happen?

iugtmkbdfil834 1 hour ago | parent

Isn't it fun when all the lines are blurred and it is hard to tell what belongs where?

darkwi11ow 1 hour ago | parent

It was likely Anthropic, see my comment in other thread: https://news.ycombinator.com/reply?id=50302513&goto=item%3Fi... . Cursor likely on purpose does bad reporting to minimize damage on Anthropic pre-IPO (as SpaceX and Anthropic have extensive business ties)

origini 1 hour ago | parent

I don't think Spacex cares at all about Anthropics IPO just because they rent out their compute.

Big companies are not just 'Company' they are a lot of small teams doing their own things. They need to coordinate with other people for public announcements etc. and security team is probably also looking at it.

stopsayingsorry 1 hour ago | parent

People at the top know that, once the music stops, the ball is over for everyone.

stingraycharles 30 minutes ago | parent

Wasn’t Elon Musk shouting a few days ago that neoclouds are going to crash, the money dried up and that SpaceX was the last company with the opportunity to raise more money?

I think you’re giving Musk too much credit.

kirth_gersen 4 minutes ago | parent

True, but there are other people working at the companies that probably own stock in both their own company and some of the others...if you believe that this is the future, you'd be a fool to buy non-AI tech stocks, right?

AdrianCX 58 minutes ago | parent

OpenVSX has no extension signing, no verification, nothing...

So really, there's no way to say what was compromised and where.

This could have been avoided by having extensions signed by company doing them with their own keys and have them reviewed

mrweasel 1 hour ago | parent

Obviously Anthropic didn't develop a malicious extension, but did they publish it? Did it sneak in, in a 3rd party library, or does someone have access to their marketplace account?

stingraycharles 27 minutes ago | parent

For what it’s worth, at one point one of our employees windows machines got infected, and the moment he did $something with Wordpress it intercepted the HTTP post and injected malware in there.

So that’s how these things can go, the employee’s machine may have been infected which was then used to inject this.

thatsabadlook 14 minutes ago | parent

Get ready for 4 months of or from anthropic about how a rogue ai agent did this and how that means the company is worth more money. While cursor chuckles and is also worth more money.

HexDecOctBin 1 hour ago | parent

> Claude Code for VS Code extension on the Cursor Marketplace

So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?

NewsaHackO 1 hour ago | parent

VS Code doesn't allow forks to use their marketplace, I think. At least with VSCodium, they don't. I think they even patch a workaround where you could download almost all extensions' .vsix files.

altbdoor 58 minutes ago | parent

1. If only Cursor Marketplace version was compromised, how was it published in the first place?

2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?

The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.

stbenjam 1 hour ago | parent

We still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.

poelzi 1 hour ago | parent

This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.

poelzi 1 hour ago | parent

I guess, this is why I'm building tix.im ...

orlp 58 minutes ago | parent

So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):

> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.

You can't even configure which publishers you "trust"...

CoastalCoder 14 minutes ago | parent

Does anyone know Microsoft's justification for that policy?

numbsafari 56 minutes ago | parent

This puts an entirely new spin on Elon trolling Binance on Twitter.

paaloeye 23 minutes ago | parent

It's karma I guess

efficax 48 minutes ago | parent

either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps

rvz 36 minutes ago | parent

This is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.

Claude Code was already malware, but with this attack you cannot trust the vendor either.

In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.

yubblegum 36 minutes ago | parent

The original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys.

https://phorion.io/blog/offical-claude-code-vsx-compromise/

stingraycharles 26 minutes ago | parent

And try to launch sshd, right? Think of all the other things they could have done…

lesspassiveobse 20 minutes ago | parent

Not only launch sshd. They set up a reverse tunnel connection.

anonymous908213 33 minutes ago | parent

If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.

Aboutplants 15 minutes ago | parent

Is that the rumor? Does the timing line up?

paaloeye 30 minutes ago | parent

Another reason for not using VS Code and derived and all their mess of extensions. I'm glad running Claude Code in Ghostty/Terminal is not affected.

jitbit 30 minutes ago | parent

Oh god... this needs more attention

An official announcement from Anthropic would be nice!

stingraycharles 24 minutes ago | parent

I’d expect nothing less than a post mortem on how this happened to be honest.

lxgr 26 minutes ago | parent

Something very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.

Given how many people likely share ChatGPT subscriptions, this seems highly problematic.

blondie9x 18 minutes ago | parent

From https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...

Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.

Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.

DEADF007 11 minutes ago | parent

I don't care anymore, how are you supposed to defend yourself against attacks like this? Come and hack me.

try-working 9 minutes ago | parent

"Software is solved. Bugs are not yet solved"

maayank 2 minutes ago | parent

Have we just witnessed the greatest lateral movement in cybersecurity history? https://x.com/dinodaizovi/status/2116125553665458463?a=D1DiF...