🔍 Read the full analysis: The Name Was Right, The Code Wasn’t: A Tampered Claude Code Update Reached Up To 5,000 Cursor Users. What To Check Now on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. The company says up to 5,000 users may have been affected; the build attempted to collect device information and establish persistent remote access. How it was published under Anthropic’s extension identity remains unexplained.
A tampered Claude Code extension was available through Cursor’s VS Code marketplace for about 11 hours on October 29, and Cursor says it may have reached up to 5,000 users. The version, 2.1.313, carried Anthropic’s extension name and identifier but was not built by Anthropic; security researchers say it attempted to collect computer details and create a persistent route for remote access.
Cursor says the modified version was listed from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It removed the version after detecting the incident, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor later audited access, rotated marketplace keys, rebuilt the marketplace and restored it, according to its security notice. It has not published the timing of each response step.
Researchers at Phorion and OpenSourceMalware describe a small loader placed ahead of the extension’s legitimate code. OpenSourceMalware counted a 66-line block in the main file; the researchers said it ran when the editor loaded the extension, without requiring the user to open Claude Code or click anything. Their analyses describe attempts to gather device information, add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts.
Cursor says the SSH-enabling step failed on most Macs and Windows computers because it required administrator privileges. The source account says the attacker’s server is now offline, but that does not establish that every other part of the activity failed. Cursor recommends checking for a key labelled svc-telemetry. If found, its advice is to use the company’s cleanup scripts; the source account also recommends considering a system rebuild and changing credentials from a separate, trusted computer.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
A Trusted Store Was the Entry Point
The incident matters because the modified package appeared as an update to the real Claude Code listing, rather than as a similarly named imitation. According to the source account and researchers cited by The Hacker News, it used the identifier anthropic.claude-code. Users with automatic extension updates could have received it without taking a separate action.
That makes the distribution channel part of the security problem. Developers often grant editor extensions access to local files, source code and development tools. A malicious update delivered through a familiar marketplace can therefore put sensitive work and credentials at risk even when a user has not knowingly installed an unfamiliar extension. Cursor’s estimate of up to 5,000 users is a maximum, not a confirmed count of infected machines.
The reported failure of the SSH step on most Macs and Windows PCs may have limited one route to remote login, but it does not show that no data was collected or that no other persistence steps succeeded. Users should treat the finding of the named key or other indicators according to Cursor’s response guidance, rather than assuming the unavailable server means a device is clean.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Release Numbers Do Not Match
Anthropic published Claude Code 2.1.312 on October 27, the last official release before the incident described in the source account. The modified 2.1.313 appeared in Cursor’s marketplace two days later. Anthropic’s public release list then moved to 2.1.314 on October 30, with no 2.1.313 release listed, according to the account’s check of the release page that day.
Anthropic has said its own systems and employee laptops were not compromised, and that its official distribution channels were unaffected. The source account says versions distributed through Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not implicated. Some early reports incorrectly named Open VSX as the source and were corrected; the reported distribution channel was Cursor’s marketplace.
Cursor said it identified the incident and removed the version. The public record described in the source does not settle who first detected the build: The Register credited Phorion, while OpenSourceMalware acknowledged a developer who alerted it. Those accounts do not change the central confirmed distinction: the affected listing was in Cursor’s marketplace, not Anthropic’s official release channel.
“The incident impacted at most 5,000 users.”
— Cursor
How the Listing Was Compromised
The central unanswered question is how the modified build was published under Anthropic’s extension identity. Cursor has not publicly explained the path into its marketplace. Anthropic’s reported statement that an attacker used access to Cursor’s marketplace does not specify whether credentials, a publishing workflow or another marketplace process was involved.
The number of users who installed or ran the package is also unknown. Cursor’s figure of up to 5,000 is an estimate of potential exposure; the source material does not provide a verified number of affected devices or evidence that every listed package executed successfully. The extent of any data collected, and whether any attacker obtained access to a machine, has not been established in the available account.
Check Cursor Installations Now
Cursor users who installed or updated Claude Code through its extension marketplace during the exposure window should check for the svc-telemetry SSH key using Cursor’s published check. If it is present, Cursor’s guidance calls for its cleanup scripts; removing the extension alone may not undo changes made elsewhere on the system. The source account advises affected users to consider rebuilding the machine and to change credentials from a different, trusted computer.
Cursor says it will contact users it identifies as potentially affected. Users should follow the company’s security notice for current instructions and watch for any revised indicators or cleanup steps. Further reporting from Cursor about how the package entered the store, alongside a clearer account of how many users actually installed it and what data may have been accessed, would help establish the incident’s full scope.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 appeared in Cursor’s VS Code marketplace on October 29. Cursor says it was available for about 11 hours and was not built by Anthropic.
How many users may have received the modified version?
Cursor says up to 5,000 users may have been affected. That is a maximum exposure estimate, not a confirmed count of users who installed or ran the extension.
What did the modified extension try to do?
Researchers say it attempted to collect computer information, add an attacker-controlled SSH key, enable remote login, open a connection to an attacker’s server and persist across restarts. Cursor says the SSH-enabling step failed on most Macs and Windows PCs because it required administrator privileges.
What should Cursor users check?
Cursor users who installed Claude Code from its marketplace during the exposure window should check for a key labelled svc-telemetry using Cursor’s instructions. If present, follow the company’s cleanup guidance; uninstalling the extension alone may not remove other changes.
Were Anthropic’s official releases or Open VSX affected?
Anthropic says its systems and official channels were not affected. The source account says Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not implicated; early reports naming Open VSX as the source were corrected.
Source: ThorstenMeyerAI.com
