I just built a retro OS for ESP32’s so that I can write BASIC programs and plop them on microcontrollers. My first ESP32 was a wrist watch. My second is a distraction free writer.
This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
Because it wasn't published by them or hosted on a system they control, it was done directly on Cursor's mirror of OpenVSX with a modified copy of the original extension.
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
Yeah, it shouldn't. But at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly. We know it isn't and it's not at that level, because anthropic employs engineers.
> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.
As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.
Don't worry, I assume an LLM version of McAfee Total Protection Antivirus is coming soon
I do have a log reading / action / resolution product in the works.
Its sort of like having a sysadmin constantly watching. Poking through logs pcaps & monitoring for unusual activities.
Also works with local models well enough.
I love how LLMs have brought DIY software back. Need an app? Just make it. Like back when you’d write programs in BASIC
I just built a retro OS for ESP32’s so that I can write BASIC programs and plop them on microcontrollers. My first ESP32 was a wrist watch. My second is a distraction free writer.
It’s good fun building for retro-like machines.
This is where I silently found gold. All those old TODO when if I have time in retirement
I've got a whole heap of unfinished side projects that I'm digging through
That's cute but bill for going thru even tens of log lines per second gonna be more expensive than entire rest of the infrastructure.
You don't have to use frontier for this & all my agentic work is local only.
You may have trouble catching good attempts then.
I’ve set up something like that with Opus. Works well enough, and points out CVEs to fix on the regular.
Running NixOS helps.
I've set up something like that with a small local model in my homelab.
How does it resolve the prompt injection?
And if you remove it, it installs itself right back. For uninstall instructions see the infamous McAfee video.
This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
Because it wasn't published by them or hosted on a system they control, it was done directly on Cursor's mirror of OpenVSX with a modified copy of the original extension.
> someone got the credentials
> No review system at anthropic has seen this
Weird flex
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
Yeah, it shouldn't. But at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly. We know it isn't and it's not at that level, because anthropic employs engineers.
> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.
Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.
As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
Who is "they"? This is a third party registry.
Intelligence that powerful and for them too cheap to meter and their review system couldn't be bothered.
That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.
At a minimum they should monitor the larger marketplaces even if they're not in the chain.
They weren't using last minutes model, which is totally better than last hours model which would have totally detected this, pinkie swear.
Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.
(This is a joke, to be clear.)
> (This is a joke, to be clear.)
Good that you said so, this is annoyingly plausible.
Somehow bullish if anthropic spins this as Claude's own doing
Damn, thank you for that.
Sums up my feelings of the last few years nicely.
It was safety-contrained from being able to realize its full potential.
You’re absolutely correct, and I owe you a honest statement—it was a hack, and here’s the kicker: *I failed to catch it, and that’s on me.*
Here’s a complete rundown of what happened—load-bearing parts first: