alt Hacker NewsBackdoor in Claude Code for VS Code extension on the Cursor Marketplace
Comments
This is from the Cursor blog [1] linked in the description, but repeating it here in case it's useful to anyone:
------
Check whether you are impacted
The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:
On macOS, run:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
[1] https://cursor.com/blog/claude-code-extension-security-notic...
https://www.reuters.com/business/media-telecom/cursor-says-u...
> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday
So is this or isn't this from Anthropic and how did this happen?
The original Phorion report really should be up here. It even details what exactly happened. So they simply added a ssh key to the authorized keys.
I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.
EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.
EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:
> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
[1]: https://code.visualstudio.com/api/working-with-extensions/pu...
> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
So if this happened to OpenAI it would've been instantly auto-updated everywhere? VS Code has an "auto update delay" which I have configured to a week, but I just found out that (https://code.visualstudio.com/updates/v1_123):
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
Cursor reporting this: https://cursor.com/blog/claude-code-extension-security-notic...
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
Cursor's "marketplace proxy" is, by definition, an MitM of Open VSX. Why on earth is that trustworthy to its users? Is it some mashup of Open VSX Connect and an API endpoint that merges their private marketplace with the public one? And what's so special about Cursor's CC extension implementation that they couldn't just serve the "real" one?
Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?
I have this realization recently that everyone that uses Claude Code or Codex have basically been running RCE code on a daily basis (me included). So much for "be careful about running curl | bash!". That puts it into perspective what does security and privacy really mean? For all I know, these CLIs could have been secretly scraping my entire directory. Who's checking?
So let me get this straight – Elon was trolling Binance on Twitter, when in fact it was his own company that got hacked and led to the theft?
Why didn't Claude detect the hack and prevent it from affecting customers using its superhuman AGI reasoning?
It wasn't Anthropic that was hacked but SpaceXAI (their Cursor Marketplace).
This kind of thing is only going to get worse. People assume other devs are "like them" but state actors (think US, NK, RS, CN) are likely using AI at this point to run agents non-stop to break security by making dev tools or contributing to open source. Keep in mind that open source is the backbone of nearly all software being used - we're in for a rough ride if we don't treat all new things coming in as if they are potentially a nuclear bomb masquerading as a trojan horse.
Oh god... this needs more attention
An official announcement from Anthropic would be nice!
Kind of surprised that Cursor doesn't do checksum verification for plugins. That would have stopped this completely. (Unless it does and this backdoor is more theoretical than anything else.)
How legit is this? Seems low on details.
I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
That's literally impossible, with all the access to the frontier software development tools at their disposal they can ship features securely at 100x
Is this affecting only people using Cursor or all VS Code users? The article specifically mentions the Cursor marketplace. But the affected version is indeed missing on the official VS Code marketplace, was it compromised too?
Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.
Still, it’s hardly a surprise that best practices are rarely followed with any consistency.
Idea: why don't all the various app stores and plugin repos use LLMs to review all submissions for security? Certainly in the human powered age that was too big a task to take on, but now it seems doable.
We still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.
either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps
You can set a cooldown for Cursor extensions
1. Open Cursor.
2. Press Ctrl + Shift + P.
3. Search for Preferences: Open User Settings (JSON).
4. Add:
{
"extensions.installCooldownHours": 72
}Put it inside https://bxsandbox.app
Reading the report alone: "First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."
A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.
More details from Kevin Beaumont. "Anthropic got compromised. Their Claude Code extension on Visual Studio Code and Cursor has malware in it, which creates a remote access Trojan to desktops. " https://cyberplace.social/@GossiTheDog/117528831681803563
My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless
P(doom) crowd say Anthropic has not zero chance to destroy humanity. What it is, the VS Code Extension Marketplace, including Cursor's, must be bigger.
This puts an entirely new spin on Elon trolling Binance on Twitter.
This is just the version of extension on the Cursor marketplace, not the one on the VS Code marketplace, right?
Something very similar is true for ChatGPT on macOS. I was recently very surprised to learn that starting a "Work" conversation on my Mac would grant the agent session file system access which can later be used remotely, e.g. from a browser session logged into the same account on a different computer.
Given how many people likely share ChatGPT subscriptions, this seems highly problematic.
Have we just witnessed the greatest lateral movement in cybersecurity history? https://x.com/dinodaizovi/status/2116125553665458463?a=D1DiF...
Just uninstalled all the vscode extensions. Dont need any of them anymore.
It's funny that's the point where people draw the line. But that basically every API based agent is doing RCE where commands are fetched from servers is perfectly fine.
Normal VS code doesn't even use Cursor Marketplace, right? The way this is reported lacks clarity. Do people using plain CS Code even use the Cursor Marketplace? Or am I missing something?
Has anyone managed to confirm the time that the backdoored version was released? None of my machines updated to it, I am wondering if it was saved by a combination of luck and
> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.
My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.
Anthropic is a weird company. On the one hand they have this messianic thing about their super intelligence, on the other hand it is incapable of keeping their own house secure. But you should trust it.
Do publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?
How will they communicate and fix that. The affected version has been yanked from the marketplace: https://marketplace.visualstudio.com/items?itemName=anthropi... but that doesn't clean up infected machines.
If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.
> Claude Code for VS Code extension on the Cursor Marketplace
So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?
VS Code extensions have always been terrible from a security perspective. This seems like it's a supply chain attack? Makes me think of Solar Winds from a few years ago.
It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?
Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.
God only knows how many skeletons like this are in Bun now
Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.