Anthropic hacked to deliver remote access trojan

Discussion overview

The thread spent far more energy correcting the framing than debating Claude itself. Several commenters argued that the incident was a malicious Claude Code extension package distributed through the Open VSX/Cursor ecosystem, not evidence that Anthropic’s core systems or model had been directly compromised. They pointed to the suspect version disappearing from official channels and release records as circumstantial evidence that a publishing credential or release path may have been abused, while others stressed that the available reports did not establish that conclusion.

There was broad agreement that an AI coding assistant extension is a potent supply-chain target: it runs in developers’ editors, may have access to repositories and credentials, and in this case reportedly installed a reverse-access mechanism. Readers also pushed back on inflated claims about tens of millions of victims, citing the marketplace operator’s estimate that the affected package reached no more than roughly 5,000 users. The practical takeaway was blunt: install AI developer tooling only from verifiable official sources and treat registry provenance as part of the product’s security boundary. A joking subthread mocked the idea that Claude’s advanced reasoning should somehow have detected or stopped the compromise, rather than offering any serious claim about model-based defense.

Points of disagreement

The sharp dispute is whether this should be described as Anthropic being hacked. One side sees the anomalous extension release and its removal from official-looking distribution paths as signs that Anthropic-controlled publishing access was likely compromised. The other says the evidence supports a poisoned third-party marketplace package, and that calling it an Anthropic breach overstates what has been established.