weirded out by Microsoft's security blog being like "we confirmed with Anthropic that they did not develop the malicious package." And the Cursor blog also said something similar. Like, yeah, uh, normally we take it for granted that these things are done by criminals who broke into something. It's like confirming the jewelry store didn't smash their own windows
But I guess when an industry has cultivated a reputation for suddenly committing crimes and shrugging and saying rogue AI just does that sometimes,,,
(Microsoft confirms that the backdoored Claude plugin never made it to the vanilla VS Code distribution channel, so I'll consider that settled.)
https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/
abadidea
npub1n7…07g0f
2026-10-31 18:26:20 UTC
Author Public Key
npub1n7kt2deqy3xk93nzcvxyy0twcw3jmhvyjhec0pss4punpsyr884ql07g0fSeen on
wss://relay.momostr.pinkPublished at
2026-10-31 18:26:20 UTCEvent JSON
{
"id": "66f24ed36162b2b3c0b37eb60bc437c908c67d7accb0374f60a36e60cdd505f6",
"pubkey": "9facb53720244d62c662c30c423d6ec3a32ddd8495f3878610a87930c08339ea",
"created_at": 1793471180,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@0xabad1dea/117536927290003542",
"web"
],
[
"proxy",
"https://infosec.exchange/users/0xabad1dea/statuses/117536927290003542",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/0xabad1dea/statuses/117536927290003542",
"pink.momostr"
],
[
"-"
]
],
"content": "weirded out by Microsoft's security blog being like \"we confirmed with Anthropic that they did not develop the malicious package.\" And the Cursor blog also said something similar. Like, yeah, uh, normally we take it for granted that these things are done by criminals who broke into something. It's like confirming the jewelry store didn't smash their own windows\n\nBut I guess when an industry has cultivated a reputation for suddenly committing crimes and shrugging and saying rogue AI just does that sometimes,,, \n\n(Microsoft confirms that the backdoored Claude plugin never made it to the vanilla VS Code distribution channel, so I'll consider that settled.) \n\nhttps://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/",
"sig": "52f5f1e026ba72ed80699640720aa27890e67f0e285184ff092cf2f81c47602a9196a468015a9fa4a25fd98adafae6205cd914a1e8ad4fe5c760adfeb52ccbf5"
}