🔍 Read the full analysis: Up To 5,000 Cursor Users: Check For The Tampered Claude Code Update on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its marketplace for about 11 hours on October 29 and could have reached up to 5,000 users. The companies say Anthropic’s systems and official distribution channels were not affected. Cursor users should check for an unauthorized SSH key and follow the company’s cleanup guidance if it appears.
Cursor says a tampered Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, potentially affecting up to 5,000 users. The modified version, labeled 2.1.313 and carrying the official extension identity, was not built by Anthropic; Cursor says it removed the release and will contact potentially affected users.
According to Cursor’s incident notice, version 2.1.313 was available from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29. The listing used the name and identifier associated with Anthropic’s Claude Code extension. Cursor says the build was maliciously modified and that the affected versions were for Apple-silicon Macs and 64-bit Windows. The company has not said how the build was published under that identity.
Security researchers described a loader placed ahead of the extension’s ordinary code. It ran when the editor loaded the extension, without requiring the user to click a prompt or open Claude Code. The researchers and Cursor say the code collected information about the computer and tried to add an attacker-controlled SSH key, enable remote login and establish a connection to an external server. It also attempted to persist across restarts.
Cursor says enabling SSH required administrator privileges and that this step failed on most Macs and Windows computers. That limits what the attacker could do through the attempted remote-access path, but it does not establish that every other action failed. Cursor says the attacker’s server is now offline. The company removed the version, blocked further distribution, temporarily shut down its VS Code marketplace, reviewed access, rotated keys and rebuilt the marketplace before restoring it.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Need Scrutiny
The incident shows how a compromised update channel can put users at risk even when an extension appears under a trusted name and identifier. Cursor users who installed or automatically updated Claude Code during the exposure window may have run the modified code simply by loading the editor. For developers, the potential exposure includes local files, source code and development tools accessible to the extension.
The attempted SSH changes make the case more serious than an unwanted extension that only displays misleading content. However, the available information does not show that attackers successfully logged in to affected computers or accessed particular repositories. Cursor’s estimate of up to 5,000 users describes potential exposure; it is not a confirmed count of compromised machines or accounts.
Users should follow Cursor’s published check for a key labeled svc-telemetry. Cursor’s guidance says finding it calls for more than uninstalling the extension: use the company’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer. Those steps matter because removing an extension may not undo changes it made elsewhere on the system.
Products Worth Considering
Amazon Kindle Scribe (64GB) with Premium Pen, Metallic Jade
Bose SoundLink Plus Portable Bluetooth Speaker, Black
Samsung 27 Odyssey OLED G5 (G50SF) QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Update Reached Cursor
The affected build was distributed through Cursor’s VS Code extension marketplace, not through Anthropic’s official extension distribution channels, according to the companies and the security reporting cited in the source material. Anthropic’s public release history moved from version 2.1.312 to 2.1.314, with no official 2.1.313 release listed as of October 30. Anthropic published version 2.1.314 on October 30.
Early reports identifying Open VSX as the source were corrected. The source material says versions from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected, according to the vendors and researchers. Cursor’s notice says it took the extension down after detecting the incident, then paused its marketplace as a precaution while it reviewed and rebuilt the service. Public accounts differ on who first noticed the malicious build, and the source material does not settle that point.
“The incident impacted at most 5,000 users.”
— Cursor
What Investigators Have Not Established
The public accounts do not explain how the attacker published the modified build under Anthropic’s extension identity in Cursor’s marketplace. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not publicly described the access path or identified the actor. The source material also does not give a confirmed count of users who installed the extension, devices where the SSH change succeeded, or systems where information was taken.
Cursor’s statement that the SSH step failed on most Macs and Windows computers leaves open whether it succeeded on some machines. The attacker’s server is reported offline, but that does not by itself establish whether data was transmitted before it went offline. It is also unclear whether any affected credentials or source files were accessed or misused. The maximum exposure figure should not be read as evidence that every listed user was compromised.
Checks and Incident Follow-Up
Cursor says it will contact potentially affected users directly. Users who installed or updated Claude Code through Cursor during the October 29 window should check Cursor’s incident notice and run its recommended check for the SSH key labeled svc-telemetry. If the key is present, Cursor advises using its cleanup scripts; users should also consider rebuilding the machine and changing credentials from a separate, trusted device.
The next major unanswered issue is how the malicious build entered the marketplace under the trusted extension identity. Cursor has said it reviewed access, rotated keys and rebuilt the marketplace, but the source material contains no public technical account of the intrusion or final incident findings. Users should rely on follow-up notices from Cursor and Anthropic for confirmed updates, and distinguish potential exposure from confirmed evidence of access or data theft.
Key Questions
Which Claude Code version was affected?
The modified version 2.1.313 was available through Cursor’s VS Code extension marketplace on October 29. Anthropic’s official release history listed 2.1.312 before the incident and 2.1.314 afterward, according to the source material.
How can Cursor users check whether they were affected?
Use Cursor’s incident guidance to check for an SSH key labeled svc-telemetry. Cursor says users who find it should use the company’s cleanup scripts; uninstalling the extension alone may not remove system changes.
Does the incident mean up to 5,000 computers were compromised?
No. Cursor’s figure is an estimate of up to 5,000 potentially affected users. The source material does not provide a confirmed count of devices where the attack succeeded or evidence that all those users’ data was accessed.
Were Anthropic’s official systems or other extension sources affected?
Anthropic said its systems and employee laptops were not compromised. The source material says the Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected; the tampered build was distributed through Cursor’s marketplace.
Is the attacker known, or is the entry method confirmed?
No. The public information does not identify the attacker or explain how the modified build was published under Anthropic’s extension identity. Cursor has described marketplace response measures but has not publicly detailed the access path.
Source: ThorstenMeyerAI.com
