🔍 Read the full analysis: Claude Code Update Tampering Reached Cursor: Questions To Ask on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Anthropic Claude Code extension, version 2.1.313, was distributed through Cursor’s marketplace for about 11 hours on Oct. 29, according to Cursor. The companies say the incident did not compromise Anthropic’s systems; the attacker’s route into Cursor’s marketplace remains unexplained.
Cursor says a tampered version of Anthropic’s Claude Code extension was available in its VS Code extension marketplace for about 11 hours on Oct. 29, potentially reaching up to 5,000 users. The version, numbered 2.1.313, used the legitimate extension’s name and identifier but was not built by Anthropic, according to Cursor and security researchers; the companies have not explained how it was published under Anthropic’s identity.
Cursor says the modified extension was available from 09:27 to 20:35 UTC on Oct. 29 (2:27 a.m. to 1:35 p.m. Pacific time). It removed the version after detection, blocked further distribution and temporarily shut down its VS Code marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor said it would contact affected users directly and estimated that at most 5,000 users could have received the extension.
Analyses by security researchers describe a loader placed ahead of the extension’s legitimate code. It ran when the editor loaded the extension, without requiring a separate click or launch of Claude Code. The code reportedly collected computer details, added an attacker-controlled SSH public key, attempted to enable remote login, opened a tunnel to an attacker’s server and added persistence mechanisms intended to survive restarts.
Cursor said the step to enable SSH required administrator privileges and failed on most Macs and Windows PCs, limiting the attacker’s ability to log in through the tunnel on those machines. The attacker’s server is now offline, according to the source material. That does not establish that no data or credentials were accessed: the key, startup entries and a system report were still delivered, and the public record does not identify which affected machines completed each step.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Trust Was Tested
The incident matters because the malicious code was delivered as an update to a real extension listing, rather than as a similarly named imitation. Users who had automatic extension updates enabled may have received it without taking an action beyond using Cursor. That makes the marketplace and its publishing controls part of the security boundary for developer tools.
Code editors can access project files, source code and other developer tools. A compromised extension can therefore expose information beyond the editor itself, although the available reporting does not establish what data was taken from individual users. The reported attempt to install an SSH key and create persistence also means that simply removing the extension may not clean a machine where the steps succeeded.
The incident also underscores a practical distinction: a familiar name and extension identifier do not, by themselves, prove that a package was produced by the named developer. For users, the immediate concern is whether the affected version ran on their machine; for Cursor and other marketplace operators, the unresolved publishing path bears on how identities and releases are verified.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Which Claude Code Builds Were Affected
The reported incident concerns Cursor’s VS Code extension marketplace, not every channel distributing Claude Code. The source material says the affected package was named Anthropic.claude-code and carried the identifier anthropic.claude-code. Anthropic’s official GitHub release history went from version 2.1.312, published Oct. 27, to 2.1.314, published Oct. 30; it contains no official 2.1.313 release.
Cursor and the researchers cited in the source material said Claude Code obtained through Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected. Some early reports incorrectly identified Open VSX as the source and were corrected. The stated scope is therefore specific to the Cursor marketplace listing, rather than an indication that Anthropic’s official distribution channels were compromised.
Anthropic technical staff member Felix Rieseberg said on Oct. 30 that the incident was not a compromise of Anthropic’s systems or employee laptops. Anthropic said a malicious actor had used access to Cursor’s marketplace. Cursor has not publicly described how the attacker gained the ability to publish the modified extension.
“At most 5,000 users”
— Cursor
How the Listing Was Compromised
The main unresolved issue is how the modified package was published under Anthropic’s extension identity. Cursor has not publicly explained the entry point or identified a responsible account or system. Anthropic’s statement that the attacker used access to Cursor’s marketplace does not specify whether that involved stolen credentials, a flaw in the publishing process or another route.
Cursor’s figure of up to 5,000 users is an exposure estimate, not a public tally of confirmed infections. The available information does not establish how many users installed or loaded version 2.1.313, which machines completed the administrator-level SSH step, or whether particular files, credentials or source code were accessed. The attacker server’s reported offline status does not answer those questions.
The source material also gives differing accounts of who first detected the incident: Cursor says it identified the issue, while reports credit Phorion or describe a developer alerting OpenSourceMalware. A definitive public detection timeline has not been established in the material provided.
Checks for Cursor Users
Cursor users who installed or updated Claude Code during the exposure window should follow Cursor’s published incident guidance and check for a key labelled svc-telemetry. The source material says that if the key is present, uninstalling the extension alone is not sufficient; users should use Cursor’s cleanup scripts. Cursor’s direct outreach to potentially affected users is also expected to provide guidance specific to the incident.
For machines where the malicious extension may have run, the source material advises considering a full rebuild and changing credentials from a separate, trusted computer. Users should avoid treating the reported failure of the administrator-level SSH step as proof that a machine was unaffected: other actions, including adding the key and sending a system report, may still have occurred.
Further clarity depends on Cursor’s investigation and any subsequent technical findings. The next significant information would include an explanation of how the package reached the marketplace, a more precise account of user exposure and confirmed effects, and any additional remediation guidance from Cursor or Anthropic.
Key Questions
Which Claude Code version was involved?
The reported tampered release was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s published GitHub releases went from 2.1.312 to 2.1.314, with no official 2.1.313 entry in the source material.
How many people may have received the extension?
Cursor said at most 5,000 users may have been affected. That is an upper estimate; the public information does not give a confirmed number of users whose machines ran the modified code.
Were Anthropic’s systems compromised?
Anthropic said its systems and employee laptops were not compromised, and that its official channels were unaffected. The reported distribution was through Cursor’s marketplace.
What should an affected Cursor user check?
Check for an SSH key labelled svc-telemetry and follow Cursor’s incident guidance. If the key is present, the source material says uninstalling the extension is not enough: use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate trusted computer.
Is it known how the attacker got the extension into Cursor’s marketplace?
No. Cursor has not publicly explained how the modified build was published under Anthropic’s extension identity. Anthropic said the attacker used access to Cursor’s marketplace, but the method remains unclear.
Source: ThorstenMeyerAI.com
