We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.
If y'alls systems were not compromised then it was Cursors?
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...
Is Cursor not an official channel for Claude?
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.