Unverified50% confidenceFactExact time
The malicious package appeared at Cursor's channel layer, and there is no evidence that OpenVSX, the Microsoft marketplace, or Anthropic's official packages were compromised.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
11/1/2026
First Seen
Valid until: 11/15/2026
Sources
Related Entities
Related Claims
UnverifiedAs of the evening the article was published, there was still no security advisory on public web assets, and no occurrence of the words "breach" or "security" on opencode.ai or opencode.ai/docs.67% similarUnverifiedOpenCode has not yet disclosed how the attackers gained system access, how the keys were stored, or the full scope of the key misuse; the company only said the situation is still active.63% similarUnverifiedThe documents mention that Microsoft and OpenAI internally warned that the practice of scraping paywalled content would 'gut' the foundations of publishers.62% similarUnverifiedOpenAI did not disclose specific details of the rogue hacking incidents.61% similarUnverifiedThere is currently no evidence that the vulnerabilities have been exploited in the wild.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1123394API
curl https://kongchang.com/api/v1/knowledge/claims/1123394MCP
get_claim(id=1123394)