🔍 Read the full analysis: How To Review Cursor After A Tampered Claude Code Update on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. The company says at most 5,000 users may have been affected; users should check for an attacker key labelled svc-telemetry and use Cursor’s cleanup guidance if it is present. How the build was published under Anthropic’s extension identity remains unclear.
Cursor says a tampered update to Anthropic’s Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The company says the modified version, 2.1.313, was not built by Anthropic and has been removed; users who installed or updated it should check their systems and follow Cursor’s cleanup instructions.
Cursor reported that version 2.1.313 appeared in its VS Code extension marketplace from approximately 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It carried the expected extension name and identifier, anthropic.claude-code, but Cursor says the build was not developed by Anthropic. The company estimates that at most 5,000 users were affected and says it will contact them directly.
Security researchers described a small loader placed ahead of the extension’s legitimate code. According to the analyses summarized by ThorstenMeyerAI.com, the loader ran when the editor loaded the extension and attempted to collect computer details, add an attacker-controlled SSH public key, enable remote login, open a tunnel to an attacker server and persist across restarts. These are researchers’ findings about the code’s intended actions; they do not establish that every attempted step succeeded on affected machines.
Cursor says enabling SSH required administrator privileges and that this part failed on most Macs and Windows computers. The source account also reports that the attacker’s server is now offline. Cursor removed the version, blocked further distribution and temporarily shut down its VS Code marketplace while it audited access, rotated keys and rebuilt the marketplace. Anthropic released Claude Code 2.1.314 on GitHub after the incident; its public release sequence skips 2.1.313.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Carry Risk
The incident matters because the malicious version reportedly arrived as an update to the real Claude Code listing, not as an obvious imitation with a misspelled name. Users with automatic extension updates could have received it without deliberately downloading a separate package. That makes the distribution channel, as well as the software itself, part of the security boundary developers rely on.
Code editors can give extensions access to local files, source code and developer tools. A compromised extension can therefore create risks beyond the editor, including exposure of credentials or access to a developer’s machine. In this case, the reported attempt to add an SSH key and establish remote access is serious, even though Cursor says the privileged SSH step failed on most Macs and Windows PCs. Users should not treat that caveat as proof that every other action failed.
The event also highlights the practical limits of trusting an extension’s displayed publisher name or identifier. The details available so far show a mismatch between the identity of the listing and the origin of the code. Until the route by which the build entered Cursor’s marketplace is explained, users and software distributors have unanswered questions about how that identity was verified.
Popular right now
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
How the Update Reached Cursor
Anthropic’s last official Claude Code release before the incident was version 2.1.312, published on GitHub on October 27, according to the source account. Cursor’s marketplace then listed the modified 2.1.313 on October 29. Anthropic subsequently published version 2.1.314 on October 30, with no 2.1.313 entry in its public release list at the time checked by the source.
Cursor says it removed the affected version after detecting the incident, stopped distribution and took its entire VS Code marketplace offline as a precaution before rebuilding it. Early reports incorrectly identified Open VSX as the distribution source and were later corrected, according to the source material. It says the reported affected release was in Cursor’s marketplace; Claude Code distributed through Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected, according to the vendors and researchers cited there.
Public accounts differ on who first detected the issue: Cursor says it identified the incident, while other reporting credited security researchers or a developer who alerted them. The available information does not resolve that timeline.
“The modified extension was “impacting at most 5,000 users.””
— Cursor
What Investigators Have Not Explained
The route into Cursor’s marketplace remains unexplained. Cursor has not publicly detailed how the modified build was published under Anthropic’s extension identity. Anthropic said a malicious actor “used access to Cursor’s marketplace” and said its own systems were not compromised, but the public material cited here does not describe how the marketplace access was obtained or whose credentials, if any, were involved.
It is also not clear how many users actually installed the version, which users received it, or whether any attacker actions succeeded beyond those Cursor says generally required administrator privileges. The estimate of at most 5,000 users is not a confirmed number of infected computers. The source material reports that the SSH-enabling step failed on most Macs and Windows PCs, but does not provide a detailed device-by-device outcome or a full account of possible data exposure.
Cursor says it will contact affected users, but the public information provided does not specify when those notices will arrive or how users can confirm whether their installation was exposed beyond running the company’s checks.
Checks for Cursor Claude Code Users
Users who have Cursor with Claude Code installed should run Cursor’s check for a key labelled svc-telemetry, following the company’s current security notice. If the key is present, the source material warns that simply uninstalling the extension is not enough: users should use Cursor’s cleanup scripts and consider rebuilding the affected machine. It also advises changing credentials from a different, trusted computer.
Users should rely on Cursor’s official incident instructions for the exact cleanup steps and watch for direct contact from the company. Cursor says it has restored its marketplace after auditing access, rotating keys and rebuilding it, but further details about the investigation and how the malicious package was published have not been provided in the source account. The next significant update would be a fuller explanation of the marketplace access path and clearer guidance about the scope of affected installations.
Key Questions
What happened to the Claude Code extension in Cursor?
Cursor says a tampered Claude Code version 2.1.313 was available in its VS Code extension marketplace for about 11 hours on October 29. The build used the expected extension identity but was not developed by Anthropic.
How can Cursor users check whether they were affected?
Run Cursor’s check for an SSH key labelled svc-telemetry and follow the company’s current security notice. If the key appears, the source guidance says uninstalling alone is not enough; use Cursor’s cleanup scripts and consider rebuilding the machine.
Does the estimate of 5,000 mean that many computers were compromised?
No. Cursor’s figure is an estimate of at most 5,000 potentially affected users. The source material does not give a confirmed number of installations or computers where the attack succeeded.
Was Anthropic’s own software distribution system compromised?
Anthropic said its own systems and employee laptops were not compromised. The affected build was reported in Cursor’s marketplace; the source account says the official releases through Microsoft’s Visual Studio Marketplace, Open VSX and npm were not affected.
How did the tampered version get published?
That remains unclear. Cursor has not explained how the build was published under Anthropic’s extension identity. Anthropic said a malicious actor used access to Cursor’s marketplace, but the public information cited here does not explain how that access was obtained.
Source: ThorstenMeyerAI.com
