Cursor statement "This malicious version of the extension was not developed by Anthropic" is a bit wordsmithy. "Developed" is doing some heavy lifting - it was uploaded to Anthropic's verified account and Cursor automatically updates extensions.
Cursor say around 5k developer systems were impacted.
I've confirmed Binance use Claude Code on Cursor with this extension.
I'm confirmed the new, replacement versions Anthropic published overnight (which auto update) do *not* remove the prior backdoors and recon activity. So SSH still reverse calls out etc, you need to manually remediate every impacted VSCode and Cursor system.
Anthropic *must* tell customers what happened in a completely transparent way.
I've written a blog - Anthropic have been hacked to deliver remote access malware to millions of endpoints where developers use Claude Code.
Seems like October may end up being the unofficial start to the long anticipate AI vulnpocalypse. Remember to take some time off and go outside now and then. You can orchestrate patches from your phone these days.
Northflank, the AI platform, has gone offline after a full blown security breach. Environment variables for access to automation at their customers have been decrypted and exfiltrated.
"Multiple users are confirmed that their AI keys have been used".
So @protonprivacy has plunged themselves into a crisis now over AI obsession and mistreating staff. Customers are leaving.
The CEO has popped up on Reddit to try to reassure customers.. who are mass downvoting his replies.
I think the lesson with the PHP stuff is that orgs who calmly figured out which assets and updated PHP and/or applied mitigations won.
It is a real vuln, and critical, and everybody did the right things defending.
Security vendors themselves need to do much better as they were hugely slow to supply patches, and often lacked ASLR and other basic mitigations.
It’s not the only critical vuln, even in PHP. Calm heads will prevail.
And stop buying the AI apocalypse hype.
Die Skepsis der Stare.
#birds
"We've made some changes to our privacy policy..."
Oh dear. I see some crypto investors have had their precious crypto beans stolen.
