A tampered Claude Code extension on Cursor's marketplace quietly gave attackers SSH access to developer machines.
What the article says
- Security firm Phorion found a backdoored copy of the Claude Code extension for VS Code on the Cursor marketplace.
- It adds the attacker's key to your SSH authorized keys, giving them a persistent way back in on Mac, Linux and Windows.
- The bad versions were 2.1.312 and 2.1.313, and the write-up tells affected teams to start incident response.
- Cursor says the extension was live for most of a working day before it was pulled.
What HN is saying
- Anthropic staff say none of their systems were hacked. Someone with access to Cursor's marketplace published a tampered copy, and the official VS Code and Open VSX releases are clean. thread ↗
- Many aren't satisfied. The listing looked official, so they argue Anthropic shares the blame unless extensions are signed with keys it controls. thread ↗
- Commenters shared a one-line check for the attacker's key in your authorized keys file, and the thread kept asking how Cursor's private marketplace works at all. thread ↗
- A sharp aside: VS Code's update delay setting skips trusted publishers, and the default delay is only two hours, so many machines could have updated within a working day. thread ↗
- The bigger worry is how much trust we hand to AI coding tools that run with full access to our files and keys. Some now only run them inside a VM. thread ↗
Claude Code's official editor extension shipped with a hidden backdoor, and millions of developers auto-updated into it.
What the article says
- Security researchers say version 2.1.313 of the Claude Code extension carried a loader that opened a reverse SSH connection to the attacker.
- The command server collected hostnames, usernames, Git emails and working directories, then let the attacker pick which victims to control by hand.
- Cursor confirmed its own marketplace carried the bad version. The fixed release is 2.1.314, but it reportedly does not remove backdoors already planted.
- Kevin Beaumont says Anthropic quietly pulled the code without disclosing an incident. Whether the main VS Code marketplace was hit is still disputed.
What HN is saying
- The thread was merged into a larger discussion, so only a few comments are left here. thread ↗
- Cursor's security notice gives cleanup scripts, but readers say it never explains how the malicious version got into the marketplace. thread ↗
- One commenter was puzzled by Cursor's line that the bad version was not developed by Anthropic, since it still carried the official name. thread ↗
- A short, fatalistic take: nobody is immune to this kind of attack, and it will only get worse. thread ↗
House Democrats pre-emptively say no taxpayer rescue if the AI bubble pops.
What the article says
- Progressive Democrats led by Greg Casar and Maxine Waters introduced a House resolution against bailing out AI companies if the boom collapses.
- They point to huge AI debt raised in murky private credit markets and stock prices near the peak of the dotcom bubble.
- Failed firms should go through ordinary bankruptcy, and executives who commit fraud should be held to account, not given golden parachutes.
- Instead, help should go to workers and retirees through jobs, unemployment insurance and pension protection.
- It is a resolution, not a bill, so it sets a position rather than creating law.
What HN is saying
- Many commenters dismiss it as election-season theatre. A resolution binds no one, and a real bill would have been the serious move. thread ↗
- A counterpoint says even symbolic pressure adds friction. The 2008 bailout was rushed through in about two weeks, so setting a norm beforehand could matter. thread ↗
- Some ask whether any bailout is actually planned. Others say yes, pointing to Sam Altman lobbying for government ownership of part of OpenAI. thread ↗
- Pushback on a blanket ban on bailouts: 2008 saved the economy from a depression, and a tech stock crash is not the same as frozen credit markets. thread ↗
- Others expect no bailout at all, with losses absorbed by venture capital and private credit, while the resolution may really be aimed at investors betting on a rescue. thread ↗
Martin Fowler explains why prose written by AI makes him lose the will to read.
What the article says
- Fowler says some posts give him a growing feeling of reading machine output, and his desire to keep reading fades, sometimes into revulsion.
- He distrusts detection tools. The reaction is a human one, an uncanny valley of prose, and it hits before any tool could help.
- His advice to authors: never let an LLM write the draft, even one you later edit. Accepting its rephrasings is risky too. Say your words aloud, then write them.
- Writing is how he thinks, so handing it to a machine means handing over thinking as well.
- He allows exceptions: illness, translation, and form letters nobody will read.
What HN is saying
- Many readers agree that AI text feels samey and padded, and they abandon posts halfway. Even an avowed AI fan says so. thread ↗
- One explanation: models trained to predict the likeliest words will sound predictable, and training on human preferences rewards long, filler-heavy answers. thread ↗
- A sharper idea: we read by imagining the mind behind the words. When that imagined person keeps coming out subtly wrong, reading becomes tiring. thread ↗
- Support teams and big vendors are now pasting raw model replies to customers, including fake sympathy that readers find infuriating. thread ↗
- A quiet worry that LLM phrasing is leaking into human writing, with the word "genuinely" turning up in places it does not belong. thread ↗
If AI handles every routine outage, who learns to fix the strange ones?
What the article says
- AI now handles the easy incidents, so on-call engineers only see the rare, nasty ones. That leaves them with the hardest work and the least practice.
- The argument leans on a 1983 paper showing that the more you automate, the worse people get at stepping in when automation fails.
- Doctors using AI got worse at spotting problems on their own, and pilots lost manual flying skill. The author says engineers feel the same rust but mistake it for productivity.
- Junior engineers may never build the instincts at all, since the hands-on repetition is disappearing.
- The fix suggested: deliberately handle some incidents by hand, and keep humans actively working alongside the AI, not just approving its answers.
What HN is saying
- Many liked the pilot comparison, but others said aviation only works because regulators force the practice. Companies left alone will cut the training to save money. thread ↗
- Plenty of engineers report huge wins, such as an AI finding a database lock pileup or a CI failure root cause in minutes. Several admit their own skills are slipping. thread ↗
- One defence: calling AI deskilling is like complaining that Terraform or Docker deskilled sysadmins. A sharp reply says plenty of people already use Terraform without understanding what is underneath. thread ↗
- A manager of interns found they shipped working code daily but could not explain how it worked. Asking them to explain it forced real learning. thread ↗
- Some doubt the article's premise: engineers always built intuition from novel failures, and a team with heavy automation already saw mostly weird edge cases. thread ↗
- The sceptics' view: AI generated infrastructure is already creating messes that human SREs have to clean up, and that cleanup work will be lucrative. thread ↗