🔍 Read the full analysis: What To Do After The Claude Code Update Tampering Reached Cursor on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. The company says up to 5,000 users may have been affected; users should check for an SSH key labelled svc-telemetry and follow Cursor’s cleanup guidance if it is present.
Cursor says a maliciously modified Claude Code extension was available in its extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The version, 2.1.313, used Anthropic’s extension name and identifier but was not built by Anthropic, according to Cursor; users who installed or automatically received it should check their machines for signs of compromise.
Cursor places the availability window between 2:27 a.m. and 1:35 p.m. Pacific time on October 29. The company says it removed the version after detecting the incident, blocked further distribution and temporarily shut down its VS Code extension marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor has not published the timing for each of those steps.
Security analyses by Phorion and OpenSourceMalware describe a loader inserted ahead of the extension’s normal code. It ran when the editor loaded the extension, without requiring the user to click or open Claude Code. Researchers say the code collected computer details and attempted to add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and persist after restarts.
Cursor says the step to enable SSH required administrator privileges and failed on most Macs and Windows computers. It also says the attacker’s server is now offline. Those points do not establish that every attempt failed or that no information was taken: the researchers’ accounts say the key, startup entries and data report could still have been created or sent. Cursor says it will contact affected users directly.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Can Put Machines at Risk
The incident matters because the modified build appeared as an update to the existing Claude Code listing, rather than as an obvious imitation with a misspelled name. Users with automatic extension updates could have received it without choosing to install a new extension. A familiar publisher name and identifier, by themselves, did not prove that this particular package came from Anthropic.
Code-editor extensions can have access to local files, source code and developer tools while they run. That makes a compromised extension channel a potential route to sensitive project material and account access. The risk is especially relevant for people who use Cursor for work involving private repositories, credentials or production systems. The incident’s reported reach is a maximum estimate, not a confirmed count of devices compromised.
The companies’ statements also draw a distinction between the affected distribution channel and Anthropic’s own systems. Anthropic says its systems were not compromised and that its official channels were unaffected. That reduces the scope of what is currently alleged, but does not explain how an unauthorised build appeared in Cursor’s marketplace under the Anthropic extension identity.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
As an affiliate, we earn on qualifying purchases.
The Marketplace Timeline and Scope
According to the source account, Anthropic’s last official Claude Code release before the incident was version 2.1.312, published on GitHub on October 27. The modified 2.1.313 appeared in Cursor’s VS Code extension marketplace on October 29. Anthropic published version 2.1.314 on October 30; its public release list went from 2.1.312 to 2.1.314, with no 2.1.313 entry.
Cursor says the affected package was not developed by Anthropic and estimates that at most 5,000 users were affected. Anthropic technical staff member Felix Rieseberg said on October 30 that the incident was not a compromise of Anthropic’s systems or employee laptops. The source material says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected; early reports naming Open VSX were corrected.
Public accounts differ on who first spotted the tampering. Cursor says it identified the incident, The Register credited Phorion with first detecting it, and OpenSourceMalware credited a developer who alerted it. The available account does not settle that chronology.
“impacting at most 5,000 users”
— Cursor
How the Fake Build Entered Cursor
The public accounts do not explain how the attacker published under Anthropic’s extension identity in Cursor’s marketplace. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not publicly detailed the entry point or attributed the activity to a named person or group.
The number of people who downloaded or ran the modified version, and whether any suffered data theft or unauthorised access, also remain unclear. Cursor’s figure is “at most 5,000 users”; the source material does not give a confirmed victim count. The attacker’s server being offline and the reported SSH restriction on most machines do not by themselves establish that all other parts of the code’s activity were prevented.
Cursor and the researchers describe the package’s behaviour, but the available reporting does not provide a complete account of what information, if any, was successfully collected or where it went. Users should treat a positive indicator as a reason to follow the vendor’s remediation guidance, not as proof that uninstalling the extension has removed every change.
Checks and Cleanup for Cursor Users
Cursor users who installed Claude Code through Cursor should run Cursor’s check for an SSH key labelled svc-telemetry. If the key is present, Cursor’s guidance, as described in the source material, is to use its cleanup scripts; simply uninstalling the extension is not enough. Users should consider rebuilding the affected machine and change credentials from a separate, trusted computer.
People who find the indicator should avoid using the potentially affected device to reset passwords or rotate credentials, because changes made from a compromised machine could be exposed. They should follow Cursor’s current instructions and their organisation’s security procedures, especially if the device had access to private repositories, deployment systems or work accounts.
Cursor says it will contact affected users, and its marketplace has been rebuilt and brought back online. The next significant information would be a fuller account of how the package was published, a clearer estimate of actual downloads and any confirmed impact. Until then, users should rely on vendor guidance and verified notices rather than assume the incident affected every Claude Code installation.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version, 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29. Cursor says it was not built by Anthropic and may have reached up to 5,000 users.
How can I check whether my machine may be affected?
Run Cursor’s check for an SSH key labelled svc-telemetry. If you find it, follow Cursor’s cleanup instructions and treat the machine as potentially affected.
Is uninstalling the extension enough?
No. The source material says Cursor recommends its cleanup scripts if the key is present, and advises users to consider rebuilding the machine. Change credentials from a separate, trusted computer.
Were Anthropic’s systems or other Claude Code distribution channels affected?
Anthropic says its systems were not compromised and its official channels were unaffected. The source material says the Microsoft Visual Studio Marketplace, Open VSX and npm package were not affected; the reported tampering was in Cursor’s marketplace.
Does Cursor know who was responsible or how the package was published?
The public information described here does not identify the responsible party or explain how the modified build appeared under Anthropic’s extension identity. Cursor has not publicly provided a full account of the marketplace access route.
Source: ThorstenMeyerAI.com
