Anthropic has not informed customers, and silently deleted the backdoored version without telling anybody.I wonder why ? ( we all know why )
The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code.
It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.
Call me crazy or unreasonable, but shouldn't a company with its hand out, ready to collect 2 trillion dollars for being "a leader in AI," be eating its own dog food, and using its own AI to secure its code before release ?
The optics and timing aren't good.
It looks like they don't care what they give you, or how much they take from you.
And yes, I know, "these things happen." I'm just saying, the total picture smells bad.
UPDATE: see paxy's comment on the hack not being internal to Anthropic. My initial comments are too harsh in light of the new info.
They shall remain here to forever embarrass me. :D
I wonder why ? ( we all know why )
The compromised version was 2.1.313. This version was replaced 8 hours ago by Anthropic, with version 2.1.314, which appears to remove the backdoor from the extension but I’m not sure if it still contains no malicious code.
It does not remove the SSH backdoor from systems already infected, nor the prior recon activity.
Call me crazy or unreasonable, but shouldn't a company with its hand out, ready to collect 2 trillion dollars for being "a leader in AI," be eating its own dog food, and using its own AI to secure its code before release ?
The optics and timing aren't good.
It looks like they don't care what they give you, or how much they take from you.
And yes, I know, "these things happen." I'm just saying, the total picture smells bad.
UPDATE: see paxy's comment on the hack not being internal to Anthropic. My initial comments are too harsh in light of the new info.
They shall remain here to forever embarrass me. :D