Backdoors in Claude Code for VS, Cursor official extensions
154 points by dsr
154 points by dsr
lol. lmao.
If this is true, then this is way too good of a supply chain attack to waste on some mere $6b crypto theft. How many distro maintainers are using Claude? Even these from "conservative" distros like Debian, which would usually be relatively hard to attack? How many folks are using Claude to work on highly security-sensitive software? Fuck it, why not grab some fresh 0days from some AI security companies? This could be the fucking mother lode if you play your cards right.
I guess I'm probably going to hold off from updating any software for a year, and go live in the woods or something. Squirrels don't have to worry about this shit.
edit: Cursor claims that only 5000 users were affected by the backdoored Claude plugin in its repos. No word on the other marketplaces yet.
To be clear: Anthropic is on HN clarifying that this was exclusively distributed by the Cursor marketplace to Cursor. It didn’t come from Anthropic or any other marketplace. The perpetrators incremented the version number to get it to update, so Anthropic skipped that version number and released a new one, but the malware was never in their release.
Yes, people are throwing around a lot of speculation in this thread without evidence, and Anthropic is pretty flatly denying nearly all of that speculation on the record.
See the statements from Anthropic employees on HN.
I think it is important to be accurate about security incidents on a technical level. This allows us to identity ways to avoid future problems. And in this case, it's really looking like it's specifically a Cursor marketplace issue.
Anthropic apparently decided to skip a version number in their own releases to avoid confusion:
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
So, who is at fault here then? Was that a breach in Cursor Marketplace itself? Or did they get access to the Cursor Marketplace account of the person responsible for uploading the extension?
As far as I can tell, you can't upload directly to Cursor's VSCode extension marketplace and there is no such thing as a "Cursor Marketplace account" (in the relevant sense; there is a separate marketplace not for VSCode extensions that you can upload to, but that's not where the compromised extension lived). You can only upload to OpenVSX, which never had the malicious version.
Assuming this understanding is correct, Cursor is the only party that could possibly be at fault.
The unfortunate part about this is that the Anthropic account on OpenVSX published the newer version, which makes it look like they fixed the issue on OpenVSX.
I continue to not really be sure if I should be updating all my software to latest and greatest as often as I can for security, or never update anything ever again for security. Glad I'm not responsible for anything security related, I imagine folks in that domain must be living a nightmare right now.
Waste on some mere $6b crypto theft.
Why not grab some fresh 0days from some AI security companies?
Why not both? The latter doesn't have a public ledger (and disgruntled customers) who can tell the story.
Linus Torvalds recently said he used Claude to help track down a tricky bug in the kernel.
I definitely do not picture Linus using Cursor, last I heard he was still using a fairly basic EMACS. I would guess he is either using Claude Code via the TUI or some other command-line agent harness.
Linus recently rewrote a portion of the kernel to address a cache contention issue using AI; there were some issues. But I'm sure he'll continue working on it and sort it out. I'm not AI fangirl and don't use it personally, but its clear that Linus, and other Linux dev's are using it and incorporating the generated code into their projects. Redhat is fully on the AI train, so I'm sure we'll see a lot in the projects they manage and in RHEL itself.
Fair. However, I mentioned it in response to the question "...How many distro maintainers are using Claude?". In other words, not just maintainers, but the Linux Grand Poobah himself admitted to using it.
Somewhere on the planet, there is a secret club of guys with GNU/Linux 2.4, OS/2, BeOS and Windows XP, laughing at you.
Ah yes, the techno-amish (as invented by the author of the webcomic Freefall). They use machinery and operating systems up to Windows XP (because living in space means the "simple life" has higher complexity requirements).
And yet each time I browse the web from Haiku I really like the experience but I fear trusting it with my sensitive personal data.
it’s not secret. It’s very open : #retrocomputing or #techno-luddisme
See also https://blog.ayom.media/ideiasdechirico/offpunk-manifesto
There's statements from Anthropic employees over at the orange site. Quoting a couple:
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
Dworken from Anthropic here, I just want to be clear: OpenVSX was not impacted in this incident, the impacted system was only the Cursor marketplace that they host. We have confirmed that no Anthropic systems or employee devices are involved in this.
Felix from Anthropic here. We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
For anyone else not familiar with the ecosystem here: there's an official VSCode extension marketplace, there's an alternative one called OpenVSX, and there's the Cursor marketplace, which proxies OpenVSX and also adds its own things. Sounds like the Cursor layer is where the compromise happened. Anthropic only publishes on the official one and OpenVSX.
Does this mean that anyone who can publish extensions on Cursor can publish new versions of any other plugin? i.e. that there are no verifications on who owns a particular name in the registry? (I can understand that for distributions like Debian, where each developer is vetted through a process, but that usually doesn't happen for marketplaces like this, so the defaults should be far more strict on a marketplace)
I don't think so. Actually I don't think Cursor supports other people publishing extensions [edit: to its VS Code extension marketplace] at all: you're just supposed to publish to OpenVSX, and then it proxies it. I do not immediately see a way that something could be published on Cursor but not OpenVSX without it coming from Cursor themselves.
(But this is just based on my own reading right now.)
What checks are done when publishing on OpenVSX? Although I think some of the enforcement belongs in the client. I think Google Play doesn't auto-update if the signing certificate changed (e.g. moving from an app store version to a test version and back requires reinstalling IIRC), but I don't know whether Cursor/VScode performs such checks.
Reading between the lines of https://cursor.com/blog/claude-code-extension-security-notice I would guess that extensions on Cursor’s marketplace are signed only by Cursor and not by original developers. It seems like someone compromised that signing key and hosting infrastructure:
We rotated our keys, rebuilt the marketplace, and brought it back online
So, all good then... (eyeroll emoji)
Proper link, to the actual article rather than a social media repost: https://phorion.io/blog/offical-claude-code-vsx-compromise/
The 2.1.313 tag is missing from https://github.com/anthropics/claude-code/ too, in both CHANGELOG.md and as a git tag. This makes me think it might have been Claude Code's CI that was compromised
GitHub Action has been a notorious source of compromises recently, so I wouldn't be particularly surprised
I was thinking maybe the cursor registry had been compromised, and they just went for a high profile plugin
I was sceptical when Anthropic said their tools pose "existential risks to humanity", but it looks like for once they did not lie.
The phorion article only mentions Cursor Marketplace not the official VS Code extension registry, am I missing something?
All of the write-ups I've seen only mention Cursor Marketplace and Open VSX (which Cursor Marketplace uses), with none of them explicitly mentioning the official Microsoft registry. This leads me to believe that perhaps the official registry did not have a compromised build... but it's hard to say with certainty without actually checking the builds. Unfortunately, it seems like since they've been pulled, it's not possible to fetch them.
EDIT: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation (https://code.visualstudio.com/api/working-with-extensions/publishing-extension#unpublishing-extensions), unpublished versions should still be discoverable:
When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.
EDIT 2: Anthropic responded to my comment on another site:
Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
From what I can tell this is the case. You have to be using Cursor with a specific extension
This is awful, but anyone who thought this wasn’t an obvious attack vector either hasn’t been paying attention or isn’t interested enough in how things work. For my part, I expected this and I’ve been trying to bring attention to scaled-up attacks against open source projects via AI. The backdoors don’t exactly fit that pattern, though. Unfortunately I am unaware of concerted efforts to address such vulnerabilities in a systematic way. OWASP is one such organization which has reliable materials and guidance, but I think there needs to be a broader community-organized and coordinated approach.
statement from Anthropic: https://news.ycombinator.com/item?id=50304129
it appears that cursor was compromised, so only their overlay on openvsx has been serving the malicious extension - vscode's registry and openvsx are fine (as is claude code itself)
Ah yeah, all the companies IT tells you to trust. Always the same story. Just like CrowdStrike, etc.
Maybe just don't trust huge complex supply chains and systems with everything?
I think one needs to learn from real world security and make sure that even when there is complexity the failsafe is simple and nobody messes with it. Because even in the physical world every time people add complexity (or replace some simple physical mechanism with software) things go wrong.