🔍 Read the full analysis: A Tampered Claude Code Update Hit Cursor Users—Check Your Setup on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s marketplace for about 11 hours on Oct. 29, Cursor says. The build attempted to collect device information and establish persistent remote access; Cursor estimates up to 5,000 users may have received it. The companies have not explained how it was published under Anthropic’s extension identity.
Cursor’s extension marketplace distributed a tampered version of Anthropic’s Claude Code extension for about 11 hours on Oct. 29, potentially exposing up to 5,000 users, Cursor says. The modified version, numbered 2.1.313, used the legitimate extension’s name and identifier but was not built by Anthropic, according to Cursor and security researchers. The code attempted to collect information about users’ computers and establish persistent remote access.
Cursor says the version was available from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29, or 09:27 to 20:35 UTC. The company says it removed the build after detecting the issue, blocked further distribution and temporarily shut down its VS Code extension marketplace while it reviewed access, rotated keys and rebuilt the marketplace. Cursor has not published the timing of each response step.
Security analyses by Phorion and OpenSourceMalware describe a small loader placed ahead of the extension’s normal code. The loader ran when the extension loaded in Cursor; researchers say users did not need to click a prompt or start Claude Code. It attempted to gather device details, add an attacker-controlled SSH public key, enable remote login, create a tunnel to an attacker server and maintain access across restarts.
Cursor says the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That limits what the reported attack could accomplish on those machines, but does not mean the package did nothing: Cursor and researchers say the key, startup entries and a data report could still be written. Cursor says the attacker’s server is now offline. It has not publicly detailed what information was transmitted or confirmed whether any system was accessed.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Marketplace Route Matters
The incident matters because the malicious code reportedly arrived as an update to the real extension listing, rather than as a separate copy with a misleading name. Users with automatic updates enabled could have received it without knowingly installing a new extension. That makes the distribution channel itself part of the security concern: a familiar publisher name and extension identifier do not, by themselves, establish that a particular build is authentic.
Code-editor extensions can run with access to local files, source code and developer tools. A successful compromise could put credentials, private code and development environments at risk, with possible consequences beyond one workstation. The available information does not establish that data was stolen or that attackers gained access to affected computers. The attempted SSH changes and persistence mechanisms nevertheless warrant checking devices that may have installed the build.
The exposure estimate is also limited: Cursor says “at most 5,000 users” were affected, not that 5,000 systems were confirmed compromised. Users should treat the number as the company’s estimate of potential reach, while recognizing that public details about how it was calculated are limited.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro 2023 14 with M3 Pro Chip, 18 GB RAM, 2 TB SSD, Space Black
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 1TB SSD, Wi-Fi 7, Space Black
As an affiliate, we earn on qualifying purchases.
What Happened to Version 2.1.313
Anthropic’s public GitHub release history went from Claude Code 2.1.312 to 2.1.314; it does not list an official 2.1.313 release, according to the source material checked on Oct. 30. The malicious build appeared only in Cursor’s VS Code extension marketplace, according to Cursor and the cited researchers. The reports say the Microsoft Visual Studio Marketplace, Open VSX and the Claude Code npm package were not affected. Early reports that named Open VSX as the distribution source were later corrected.
Cursor says it removed the extension version, blocked distribution and took the marketplace offline as a precaution before auditing access, rotating keys and rebuilding it. Anthropic said its own systems were not compromised and its official distribution channels were not affected. On Oct. 30, Anthropic technical staff member Felix Rieseberg stated that the incident was not a compromise of Anthropic systems or employee laptops.
Public accounts differ on who first detected the malicious build. Cursor says it identified the incident; The Register credited Phorion with spotting it, while OpenSourceMalware thanked a developer who alerted the group. The source material does not establish a definitive first discovery time or person.
““impacting at most 5,000 users””
— Cursor
How the Fake Build Was Published
The route used to publish the tampered extension remains unexplained. The build reportedly appeared under Anthropic’s name and the legitimate identifier, anthropic.claude-code, but neither Cursor nor Anthropic has publicly provided a detailed account of how that happened. Anthropic said a malicious actor “used access to Cursor’s marketplace”; that statement does not explain how the access was obtained or whether a publisher account, marketplace process or another mechanism was involved.
It is also not clear from the public information how many users actually installed the build, which systems received it, or whether any attacker-controlled SSH access succeeded. Cursor says enabling SSH failed on most Macs and Windows computers and that the server is offline, but those details do not establish the outcome on every potentially affected device. The scope of any data collection and whether transmitted information was accessed or retained have not been specified.
Checks for Cursor Users
Cursor users who installed or updated Claude Code around Oct. 29 should check Cursor’s incident guidance for a public SSH key labelled svc-telemetry. The source material says Cursor provides a check for the key. A match should be treated as a sign that the system needs further investigation, not as proof by itself that an attacker successfully logged in.
Uninstalling the extension alone may not remove changes made by the tampered build. Cursor’s guidance calls for using its cleanup scripts; affected users should consider rebuilding the machine and changing credentials from a different, trusted computer. Users should follow Cursor’s current instructions and avoid entering fresh credentials on a device they suspect may be compromised.
Cursor and Anthropic may provide further information about the marketplace entry, the investigation and remediation. Until they do, users should distinguish the confirmed availability of the malicious build from unresolved questions about successful access and data exposure.
Key Questions
Was the affected extension an unofficial copy?
No. The reported build was distributed under the legitimate extension name and identifier in Cursor’s marketplace, but Cursor says it was not built by Anthropic.
How can Cursor users check for signs of the tampered build?
Cursor’s incident guidance directs users to check for an SSH key labelled svc-telemetry. Users should consult Cursor’s instructions for the check and cleanup steps.
Does finding the key prove a computer was accessed?
No. The key is a sign that the tampered extension may have made changes, but the public information does not establish that an attacker successfully logged in to every device where it appeared.
Were Claude Code users on other distribution channels affected?
The cited statements and analyses say the Microsoft Visual Studio Marketplace, Open VSX and npm package were not affected. The reported exposure was through Cursor’s VS Code extension marketplace.
Is removing the extension enough?
Not necessarily. Cursor’s guidance says uninstalling alone may not remove changes; it advises using its cleanup scripts and considering a rebuild for affected systems.
Source: ThorstenMeyerAI.com
