You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.

Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.

The situation is confusing, so can I please confirm the following:

* "Cursor Editor" is a fork of VS Code

* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system

* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected

Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?

Ok, so... Summing this up

- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.

So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)

If this isn't a damning indictment of Cursor, I don't know what is. Perhaps it will be the death knell.

What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.

I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?

The extensions does not need full access to the laptop.

When you are invited to someone's living room, you don't get to access their bedroom.

The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.

All these security issues have made me want to build more of my own slimmed down tools. It would be great if there were better ways to use claude code with my own minimal harness and still have access to the pro plan.

I'd suggest stop to use the word 'only' as it can be perceive wrongly here.

you can simply say Cursor users were affected. or exclusively.

just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.

'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.

Why was version 2.1.313 silently deleted from OpenVSX, Visual Studio Marketplace and Cursor then?

https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...

Why was the npm version 2.1.313 yanked?

https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...

smooth sloperators, smooooooooth sloperattorrrrrssss

> The versions on our official channels are not affected and this only impacts Cursor users.

Is Cursor not an official channel for Claude?

[flagged]

Memphis will remember each and every one of you

[flagged]

> We’re working with Cursor on this incident

Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.