All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Anthropic hacked - Malware inserted in official Claude Code plugins for VS Code and Cursor
CloudHopper
Member
Yesterday, Anthropic were compromised and a Visual Studio Code and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack.
Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.
The extension itself auto updated in Visual Studio Code (VSCode) and Cursor to the malicious version. The extension has over 40 million installations.
If you use the Claude Code plugins in either VS Code or Cursor you should check your SSH authorized_keys file and check for other compromise activity in your dev environment because the plugin auto-updates so it may well have quietly installed malware without you noticing.
Comments
lol, what a day. Multiple security breaches.
We live in wild times.
We live in a dangerous digitalised world
You know what's hilarious, this seems to be related to the Binance situation 🤣
Amazing how Anthropic wants this so hush hush…while not caring what wrong vuln diagnoses are doing to multiple projects. PoS
Fun timing with their IPO plans.
Whenever someone shows you who they are, believe them!
I wonder what will happen to all those people who are letting claude manage they banking accounts and such.
Congrats! The ai clowns have found a new vector for speeding up their demise. Commendable.
(And of bloody course they lied and tried to hide it!)
Well, we are still living, we should be be thankful for that.
At some point you wonder if they're doing it on purpose just to unleash havoc.
In this particular case it's not on purpose as it's affecting them too. Yes, Anthropic and others are unleashing havoc on purpose but they lack proper control mechanisms so sometimes they do it (sometimes unintentionally) and become victims of their own actions.
anthropic want to go in stock exchange soon. If that failing, no more claude.
its time go start living again offline, not online anymore.
Yeah, we live in wild times where hosting providers like PulsedMedia rely fully on AI support and terminate customer accounts for trying to get a hold of a human after being stuck in an AI support loop when their server has been down for 10+ days.
Meanwhile, the host owner is busy spending time commenting in AI threads instead of helping his customers.
Sigh, I hope no security breach happens with that AI support bot PulsedMedia uses, sighhh.
PulsedMedia is a particular type of ticking time bomb, one that keeps ticking and exploding simultaneously in a semi controlled way.
A sequence of minor explosions but never a big big one, if you expect to see a spectacular explosion then you will be disappointed because you will not see one.
If done properly this type of semi controlled time bomb can go on exploding forever.
s0n1c’s version omits the eKo's 5 Oct acknowledgment that power cycles were exhausted and no MD8 was free, he wanted us to break process and to get special treatment.
Ban was for support process abuse, repeatedly, not for asking support. His own 2020 thread exclaims how he should use LET to pressure for support.
The short misleading version keeps spreading because it requires no reading or comprehension.
@aphex using API from official is not safe too, i guess we need run AI in VMs
do a jar and give us a sonic is psycho sale
And what you have omitted is that you have not even tried to defend your case to @jbiloh, because it looks like you'll be losing your Provider Tag soon:
Microsoft says this is cursor related only.
https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/
Its a pity that the checkbox for auto updates is default, I would disable that for every plugin in VSCode.
Interesting. Microsoft seem to be saying it was Cursor that got hacked and not Anthropic...
If true, we've probably unfairly maligned Anthropic for not reporting the incident themselves.
Yeah, it was clear right away it had nothing to do with Anthropic.
It comes down to two habits though: don’t take extension updates the day they ship (and stop auto updating extensions. that’s how those 5,000 Cursor users got hit without clicking or installing anything), limit what a bad one could steal if it gets through (adding passphrase to your ssh is a good place to start). Not a cure, but a good place to start.
You're the only one thinking this is special treatment. You have defective services and inadequate processes to detect and fix them. You're overestimating your bot and services capabilities.
Motherfucker, your bot wasn't providing a working support solution. If you provided adequate support and escalated the issue, this 100% would be avoided.
You are one obtuse idiot. You still don't realize you're in the wrong.
The article under the link you included has been updated too :
Update: Anthropic say the breach was Cursor: “A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this”