Post by @nixCraft@mastodon.social

2026-10-30 11:50 UTC

Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor. The malware allowed hands on and automated remote access to developer laptops and desktops, in a supply chain attack. Anthropic has not informed customers, and the malicious version was silently deleted the backdoored version without telling anybody https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2 Why didn't Claude detect the hack ? LOL

Replies (8)

@junes@todon.nl 2026-10-30 11:53

@nixCraft@mastodon.social > and the malicious version was silently deleted the backdoored version without telling anybody I don't get this passage

Open ##5333380
@nixCraft@mastodon.social 2026-10-30 11:57

Why didn't so called Super AGI detect the hack and prevent it from affecting customers with its advanced AGI reasoning? What it was doing? eating glue? 🤣 IPO bond Anthropic is doing everything it can to hide info. Y'day Google, Amazon, Intel and so called AI stock crashed 7-25%. Let the crash start and pop the stupid AI bubble.

Open ##5333450
@seanreilly@mastodon.social 2026-10-30 12:00

@nixCraft@mastodon.social was this Anthropic being compromised or the OpenVSX registry. My understanding is that it's OpenVSX that was compromised, or specifically, OpenVSX doesn't check the software that people register with them before linking millions of users to it.

Open ##5333536
@Fedihacker@masto.es 2026-10-30 12:02

@nixCraft@mastodon.social Giving a webservice write and execution access to your devices is crazy.

Open ##5333567
@olonam@masto.nuvadi.net 2026-10-30 12:50

@nixCraft@mastodon.social

Open ##5335637
@numodular@c.im 2026-10-30 13:16

@nixCraft@mastodon.social Clandestine has morphed to Claudestine.

Open ##5336952
@ltaulell@universites.social 2026-10-30 13:31

RE: https://mastodon.social/@nixCraft/117529709526220676 @juliensalort@physfluids.fr Ça : (@ffeth@hostux.social en CC)

Open ##5337524
@gbargoud@masto.nyc 2026-10-30 14:02

@nixCraft@mastodon.social Also since it looks like the attack involved adding entries to .ssh/authorized_keys, upgrading to the non backdoored version does not make the computer safe.

Open ##5338891