🔍 Read the full analysis: How A Tampered Claude Code Update Reached Cursor Users on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, appeared in Cursor’s extension marketplace on Oct. 29 and was available for about 11 hours. Cursor says at most 5,000 users may have been affected; the build attempted to collect system information and establish persistent remote access. The companies have not explained how it was published under Anthropic’s extension identity.
A tampered Claude Code extension, version 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on Oct. 29, potentially reaching up to 5,000 users, Cursor said. The build used Anthropic’s extension name and identifier but was not made by Anthropic, and researchers said it attempted to collect computer details and create a way for an attacker to access infected machines remotely.
Cursor said the modified extension was available from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29. It identified affected builds for Apple-silicon Macs and 64-bit Windows. The company said it removed the version after detecting it, blocked further distribution and temporarily shut down its VS Code extension marketplace while it reviewed access, rotated keys and rebuilt the marketplace.
Security analyses from Phorion and OpenSourceMalware described a loader placed ahead of the extension’s legitimate code. According to OpenSourceMalware, the added block was 66 lines; the malicious code ran when the editor loaded the extension, without requiring a user to open Claude Code or click a prompt. The researchers said it gathered system information, added an attacker-controlled SSH public key, attempted to enable remote login and opened a tunnel to an attacker’s server.
Cursor said the step to enable SSH required administrator privileges and failed on most Macs and Windows computers. That limited the remote-login part of the attack on those machines, according to the company, but does not establish that no other data or changes were made. Cursor said the attacker’s server is now offline. The reported ceiling of 5,000 potentially affected users is Cursor’s estimate, not a confirmed count of compromised devices.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Carry Risk
The incident shows how a malicious update can reach users through a familiar software distribution channel rather than through a misspelled imitation. The reported build carried the real extension name and identifier, and users with automatic updates enabled could have received it without taking a separate action, according to the source reports.
Code editors often have access to project files and developer tools. Phorion said a backdoored extension can access local files, source code and tooling as soon as its module loads. That creates potential risks for developers and the organizations whose code and credentials are available on their machines, even where the attempted SSH setup did not succeed.
The event also leaves a security question for extension marketplaces: how a package associated with a trusted publisher can be replaced or distributed under that identity. Cursor has not publicly described the route by which the altered build entered its marketplace. Without that account, users and other marketplace operators cannot yet assess the precise control that failed.
Products Worth Considering
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
Apple MacBook Pro 14 2021 with M1 Max, 64GB RAM, 2TB SSD, Silver
Apple MacBook Pro 2023 with M2 Pro Chip, 14‑inch, 16 GB RAM, 512 GB SSD – Space Gray
As an affiliate, we earn on qualifying purchases.
The Release and Marketplace Timeline
Anthropic’s public GitHub release list showed Claude Code 2.1.312 on Oct. 27 as the release before the incident. The altered 2.1.313 appeared in Cursor’s marketplace on Oct. 29; Anthropic later published 2.1.314 on GitHub, skipping 2.1.313 in its public release list, according to the source material.
Cursor said it removed the extension and took its marketplace offline as a precaution, then audited access, rotated keys, rebuilt the marketplace and restored it. On Oct. 30, the company posted that the extension may have affected at most 5,000 users. Anthropic said its systems and employee laptops were not compromised. The source material says early reports that named Open VSX were corrected: the affected distribution was Cursor’s marketplace, not Open VSX.
“The modified extension was impacting at most 5,000 users.”
— Cursor
How the Altered Build Got Listed
The publication path remains unexplained. Cursor has not said how the modified package was placed in its marketplace under Anthropic’s extension name and identifier. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the source material does not provide further detail about the access or how it was obtained.
It is also not clear how many users actually installed or updated to version 2.1.313, how many machines sent system information, or whether any attacker-controlled SSH access succeeded. Cursor’s statement that SSH activation failed on most Macs and Windows PCs does not establish what happened on every potentially affected device. The attacker server is reported offline, but the material does not say whether any data collected before shutdown was accessed or retained.
Checks for Cursor Claude Code Users
Cursor users who had Claude Code installed during the exposure window should run the company’s check for an SSH key labelled svc-telemetry. According to the source material, finding that key calls for more than uninstalling the extension: users should follow Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer.
Cursor said it would contact affected users directly. Further updates from Cursor could clarify the investigation, affected-user count and how the extension entered its marketplace. Until the companies provide those details, users should treat the reported ceiling as a potential-reach estimate and use the vendor’s stated checks rather than assuming the issue was limited to successful SSH access.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 appeared in Cursor’s extension marketplace on Oct. 29. Cursor said it was not built by Anthropic and was available for about 11 hours.
How many users may have been affected?
Cursor said the extension may have reached at most 5,000 users. That figure is a potential reach estimate; the confirmed number of installations or compromised devices has not been stated in the source material.
What did the modified extension attempt to do?
Researchers said it tried to collect computer information, add an attacker’s SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts. Cursor said enabling SSH required administrator rights and failed on most Macs and Windows PCs.
What should affected Cursor users check?
Check for an SSH key labelled svc-telemetry, using Cursor’s instructions. If it is present, the source material says uninstalling alone is not enough: use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from another trusted computer.
Was Anthropic’s own software distribution compromised?
Anthropic said its systems and employee laptops were not compromised. The reported incident involved Cursor’s marketplace; the source material says early reports naming Open VSX were corrected.
Source: ThorstenMeyerAI.com
