🔍 Read the full analysis: A Security Checkup For Cursor Users After Claude Code Update Tampering on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A modified version of Anthropic’s Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29. Cursor says up to 5,000 users may have been affected; it advises users to check for a suspicious SSH key and follow its cleanup guidance if found.
Cursor says a tampered Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The modified version, listed as Anthropic’s Claude Code 2.1.313, was not built by Anthropic and attempted to collect device information and establish persistent remote access, according to Cursor and security researchers.
Cursor says the extension was available from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It removed the version after detecting the issue, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor says it audited access, rotated marketplace keys, rebuilt the marketplace and later restored it. The company has not publicly explained how the modified build was published under the legitimate extension’s name and identifier.
Researchers at Phorion and OpenSourceMalware described a loader placed ahead of the extension’s ordinary code. It ran when the editor loaded the extension, without requiring the user to open Claude Code or click a prompt. The code reportedly collected information about the computer, added an attacker’s SSH public key, attempted to enable remote login and opened a tunnel to an external server. Researchers also reported persistence mechanisms intended to survive restarts.
Cursor says the attempt to enable SSH required administrator privileges and failed on most Macs and Windows PCs, limiting the attacker’s ability to log in through the tunnel on those systems. That does not mean no activity occurred: the researchers said the key, startup entries and a data report could still be created. Cursor says the attacker’s server is now offline. It advises affected users to check for a key labelled svc-telemetry; removing the extension alone may not remove other changes.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Carry Risk
The incident matters because the tampered package appeared as an update to the real Claude Code listing, rather than as an obvious copycat extension. Cursor users with automatic extension updates could have received it without taking a separate action, according to security researcher Jenn Gile, quoted by The Hacker News. A trusted name and identifier therefore did not establish that this particular build came from Anthropic.
Code editors often have access to project files, source code and developer tools. Phorion said a compromised extension can access local files and developer tooling when its module loads. That creates potential exposure for developers and organizations even where the attempted remote-login step fails. The incident also highlights the role of extension marketplaces: a compromise or misuse of a distribution channel can put a modified package in front of users who rely on that channel for updates.
The confirmed scope remains limited to what Cursor has stated: at most 5,000 users may have been affected. That is not a confirmed count of infected machines or successful remote logins. The available information indicates the extension attempted several actions, while the success and consequences of those actions may vary by system and permissions.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Breville Bambino Espresso Machine, Brushed Stainless Steel (BES450BSS)
Ninja DualZone Air Fryer 10 Qt Smart 6-in-1 Grey (DZ950)
As an affiliate, we earn on qualifying purchases.
The Affected Cursor Marketplace Build
The affected package was identified as Anthropic.claude-code version 2.1.313, using the legitimate extension identity in Cursor’s VS Code marketplace. Anthropic’s official release history went from version 2.1.312, published on GitHub on October 27, to version 2.1.314, published on October 30. The public release list contains no official 2.1.313 entry, according to the source material.
Anthropic said its systems and employee laptops were not compromised. The company also said its official distribution channels were not affected. The source material says the Claude Code extension distributed through Microsoft’s Visual Studio Marketplace and Open VSX, as well as the npm package, was not affected. Early reports that named Open VSX were corrected.
Cursor said it removed the version and took its marketplace offline as a precaution before auditing and rebuilding it. Its public statement placed the potential number of affected users at no more than 5,000. The incident was reported by security researchers and news organizations on October 30, the day after the marketplace window closed.
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
— Jenn Gile, co-founder of OpenSourceMalware, quoted by The Hacker News
How the Listing Was Tampered
How the modified build entered Cursor’s marketplace under Anthropic’s extension identity has not been explained publicly. Cursor has not detailed the publication path or identified a responsible person or group. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the source material does not provide further detail about how that access was obtained.
The total number of users who actually installed or ran the build is also unknown. Cursor’s figure of at most 5,000 potentially affected users is an upper estimate, not a confirmed count of compromised devices. Public information does not establish how many systems successfully enabled SSH, whether anyone connected through the tunnel, what information was accessed or whether data was taken beyond the reported collection attempt. Cursor says the attacker’s server is offline, but the source material does not independently verify that status.
Checks for Cursor Users
Cursor users who installed Claude Code through its marketplace should follow Cursor’s security notice and check for an SSH key labelled svc-telemetry. If the key is present, Cursor says users should use its cleanup scripts; uninstalling the extension alone may not remove persistence-related changes. The source material also advises considering a rebuild of the machine and changing credentials from a different, trusted computer.
Users should treat those steps as precautionary guidance, not proof that every installation was compromised. Cursor has said it will contact affected users directly. Further details from Cursor about how the package was published, the final number of affected users and the results of its investigation would help clarify the incident’s scope. Until then, users should rely on vendor notices and avoid using a potentially affected machine to change sensitive credentials.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 appeared in Cursor’s VS Code extension marketplace on October 29. Cursor says it was not built by Anthropic and was available for about 11 hours before removal.
How can Cursor users check for a possible change?
Cursor’s guidance is to check for an SSH key labelled svc-telemetry. Users who find it should follow Cursor’s cleanup instructions; simply uninstalling the extension may not remove other changes.
Does the incident mean Anthropic was hacked?
Anthropic said its own systems and employee laptops were not compromised and its official channels were unaffected. The modified build was distributed through Cursor’s marketplace; how it was published there has not been explained publicly.
Were all Claude Code downloads affected?
No. The source material says the affected build was in Cursor’s marketplace. Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were reported as unaffected; early reports naming Open VSX were corrected.
How many users were affected?
Cursor said up to 5,000 users may have been affected. That is a maximum estimate, not a confirmed count of users who installed the extension or experienced a successful remote login.
Source: ThorstenMeyerAI.com
