🔍 Read the full analysis: Cursor Users And The Tampered Claude Code Update: A Checklist on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a tampered Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29 and could have reached at most 5,000 users. The extension attempted to collect system details and establish remote access; Cursor advises users to check for an SSH key labelled svc-telemetry and use its cleanup guidance if found.
Cursor says a modified version of Anthropic’s Claude Code extension, version 2.1.313, was available in Cursor’s VS Code extension marketplace for about 11 hours on October 29, potentially affecting at most 5,000 users. The build used the extension’s real name and identifier but was not developed by Anthropic, and its code attempted to collect information about computers and create a way for an attacker to connect remotely.
According to Cursor, the version appeared at 09:27 UTC (2:27 a.m. Pacific) and was removed at 20:35 UTC (1:35 p.m. Pacific). Cursor says it blocked further distribution and shut down its VS Code marketplace while it audited access, rotated keys and rebuilt the marketplace. It later brought the store back online. The company has not published timings for each of those response steps.
Researchers at Phorion and OpenSourceMalware described a small loader placed ahead of the extension’s normal code. Their analyses say it ran when the editor loaded the extension, without requiring the user to open Claude Code or click a prompt. The code attempted to gather computer details, add an attacker-controlled SSH public key, enable remote login, open a tunnel to an attacker’s server and persist across restarts.
Cursor says enabling SSH required administrator privileges and that this step failed on most Macs and Windows computers. It also says the attacker’s server is now offline. Those points limit what the reported attack could accomplish, but do not establish that no data was collected or that every affected computer is clear. Cursor recommends checking for a key labelled svc-telemetry; where it is present, uninstalling the extension alone is not sufficient, according to its guidance.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Marketplace Listing Matters
The incident highlights the risk of trusting an extension because it appears under a familiar name. The altered package reportedly appeared as an update to the genuine listing, using the identifier anthropic.claude-code, rather than as an obvious look-alike. Users with automatic extension updates may have received it without taking a separate action.
For developers, an editor extension can operate in an environment containing source code, local files and development tools. A compromised distribution channel can therefore expose more than the extension itself. Cursor’s estimate of up to 5,000 affected users is a ceiling, not a confirmed count of installations or successful remote access. The distinction matters: the available reports describe attempted actions, while the companies have not publicly established how many machines were compromised or what information, if any, left them.
Products Worth Considering
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
How Version 2.1.313 Reached Cursor
Anthropic’s public release history moved from Claude Code 2.1.312 to 2.1.314, with no official 2.1.313 release listed as of October 30, according to the source material. Anthropic published 2.1.312 on October 27 and released 2.1.314 on October 30. The tampered 2.1.313 was distributed through Cursor’s VS Code extension marketplace, not through Anthropic’s official release listing.
Cursor’s account and the security researchers’ analyses identify that marketplace as the affected channel. Early reports that named Open VSX as the source were corrected, according to the source material. It says the Claude Code extension from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Those distinctions are useful for determining exposure, but users should rely on the specific distribution route they used rather than assuming all installs are covered by a single status report.
“The modified extension was impacting at most 5,000 users.”
— Cursor
The companies have not explained how the modified package was published under Anthropic’s extension identity. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not publicly detailed the route by which the attacker gained the ability to publish or alter the listing. The available reporting also does not establish who first detected the incident: Cursor says it identified it, while reports credit researchers and a developer alert.
The potential-user figure is an upper estimate, and the public information does not say how many people installed or loaded the extension. It also remains unclear whether any users experienced a successful remote login, what information might have been transmitted, or whether the offline server retained data gathered before it went offline. Cursor’s statement that SSH activation failed on most Macs and Windows PCs does not resolve those questions for every device.
Checks for Cursor Claude Code Users
Cursor users who installed Claude Code through its marketplace should follow the company’s current security notice and check for an SSH key labelled svc-telemetry. If the key is present, Cursor says to use its cleanup scripts rather than relying on uninstalling the extension alone. The source material also advises considering a rebuild of the machine and changing credentials from a separate, trusted computer; users should consult Cursor’s instructions for the appropriate steps for their system.
Cursor says it will contact affected users directly, but the public account does not specify when those notifications will be complete. The next developments to watch are any further details from Cursor about how the marketplace listing was altered, an updated assessment of affected installations, and additional findings about exposure. Anthropic says its official channels were not affected; users should check the status of the particular marketplace or package source from which they installed Claude Code.
Key Questions
Which Claude Code version was tampered with?
The affected build was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public release list went from 2.1.312 to 2.1.314, with no official 2.1.313 entry listed as of October 30.
How can Cursor users check whether they may be affected?
Cursor advises users to check for an SSH public key labelled svc-telemetry and follow its security notice. If that key is present, the company’s guidance says uninstalling the extension is not enough; use the provided cleanup steps.
Did the extension successfully give the attacker remote access?
That has not been established for all affected computers. Cursor says the attempt to enable SSH required administrator rights and failed on most Macs and Windows PCs, and says the attacker’s server is offline. The public information does not confirm whether any individual machine allowed a successful login.
Were Claude Code downloads from other sources affected?
The source material says the versions from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. The reported incident involved the Cursor VS Code extension marketplace; users should verify the source they used.
How did the modified extension enter Cursor’s marketplace?
That remains unknown publicly. Anthropic said a malicious actor used access to Cursor’s marketplace, but Cursor has not explained how the package was published under Anthropic’s extension identity.
Source: ThorstenMeyerAI.com
