Anthropic hacked to deliver remote access trojan to Claude developer laptops

> Today we identified a security incident involving a specific extension package in the Cursor VS Code extension Marketplace: Anthropic.claude-code version 2.1.313. This malicious version of the extension was not developed by Anthropic. At most 5,000 users were affected, and we will reach out directly.

So why is this being framed as Anthropic being compromised?

I don’t think this is even worthy of discussion. The medium post is straight up lies. Flagged.

So is this the most plausible way that binance was hacked so far?

I wonder why ? ( we all know why )

The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code.

It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.

Call me crazy or unreasonable, but shouldn't a company with its hand out, ready to collect 2 trillion dollars for being "a leader in AI," be eating its own dog food, and using its own AI to secure its code before release ?

The optics and timing aren't good.

It looks like they don't care what they give you, or how much they take from you.

And yes, I know, "these things happen." I'm just saying, the total picture smells bad.

UPDATE: see paxy's comment on the hack not being internal to Anthropic. My initial comments are too harsh in light of the new info.

They shall remain here to forever embarrass me. :D