🔍 Read the full analysis: Up To 5,000 Cursor Users Reached By A Tampered Claude Code Update on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a tampered Claude Code extension, version 2.1.313, was available through its extension marketplace for about 11 hours on Oct. 29 and may have reached up to 5,000 users. The code attempted to collect device information and establish persistent remote access; Cursor says administrator permissions needed for SSH access were unavailable on most Macs and Windows PCs. The route by which the altered build was published under Anthropic’s extension identity remains unexplained.
Cursor says the modified extension was available from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29, or 09:27 to 20:35 UTC. The company says it removed the version after detection, blocked further distribution and temporarily shut down its VS Code marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor has not published exact times for those follow-up actions.
Researchers at Phorion and OpenSourceMalware described a short loader placed before the extension’s legitimate code. OpenSourceMalware said the loader ran when the extension loaded, without a user having to click or open Claude Code. The analysis said it sought device details, added an attacker-controlled SSH public key, tried to enable remote login, opened a tunnel to an attacker’s server and added persistence mechanisms so the changes could survive restarts.
Cursor said enabling SSH required administrator privileges and that this step failed on most Macs and Windows PCs. That limits what the attackers could do through the attempted remote-login route, but does not establish that every other action failed. Cursor said the attacker’s server is now offline. Anthropic said its own systems were not compromised and that its official distribution channels were unaffected; the altered build was distributed through Cursor’s marketplace, not through the official releases described in the source material.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Store Trust Matters
The incident matters because the malicious code appeared as an update to the existing Claude Code listing, rather than as a similarly named imitation. According to the reports cited by the source, the build used the expected extension identifier, anthropic.claude-code. Users who rely on automatic extension updates could have received the altered package without taking an extra action.
Code editor extensions can access local files, source code and developer tools when they run. That makes an extension marketplace a consequential software distribution channel: a compromise or misuse there can place untrusted code inside a developer’s working environment. The potential exposure is significant even though the available information does not show how many people installed the build or whether any user’s credentials or data were taken.
Cursor’s estimate of up to 5,000 users is a maximum figure, not a confirmed count of infected machines or successful intrusions. The company said it would contact affected users directly. Users should treat the attempted key installation and data reporting seriously while distinguishing those actions from the separate, more privileged step of enabling SSH, which Cursor says usually failed on Macs and Windows PCs.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Anker SOLIX C1000 Gen 2 Portable Power Station
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
The Update and Removal Timeline
The affected version was 2.1.313. Anthropic’s public release list, as checked on Oct. 30 according to the source, moved from version 2.1.312 to 2.1.314, with no official 2.1.313 release listed. Anthropic released 2.1.314 on Oct. 30, after the marketplace incident.
Cursor said it removed the modified build and took its marketplace offline as a precaution before auditing and rebuilding it. The source reports that early accounts incorrectly identified Open VSX as the source; those reports were corrected. It says the affected distribution was Cursor’s VS Code extension marketplace, while Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected, according to the vendors and researchers cited.
Responsibility for initially detecting the package is not settled in the source’s public account. Cursor said it identified the incident; The Register credited Phorion with spotting it; OpenSourceMalware acknowledged a developer who alerted the group. These accounts do not establish a single confirmed first discovery.
““impacting at most 5,000 users””
— Cursor
How the Altered Build Was Published
The central unresolved issue is how the tampered version entered Cursor’s marketplace under Anthropic’s name and extension identity. Cursor has not publicly explained the publishing route. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the material provided does not establish how that access was obtained or who the actor was.
It is also not clear how many users installed the package, what information—if any—was successfully transmitted, or whether any attacker-controlled SSH key was used to log in. Cursor’s statement that SSH activation failed on most Macs and Windows PCs does not confirm that it failed on every affected system. The source says Cursor would contact users, but provides no completed user-by-user impact count.
The claims that Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were unaffected are attributed to the vendors and researchers cited in the source. The available material does not give independent technical findings for each channel.
Checks for Cursor Users
Cursor users who have Claude Code installed should follow the company’s incident guidance and check for a key labelled svc-telemetry, the source says. If it is present, simply uninstalling the extension may not remove changes made elsewhere on the system. Cursor’s cleanup scripts are recommended in the source material; it also advises considering a rebuild of the machine and changing credentials from a separate, trusted computer.
Users should rely on Cursor’s direct notices and its official security guidance for instructions specific to their systems. The source does not reproduce the scripts or provide enough detail to verify their operation, so this article does not supply commands to run. Anyone unsure whether a system is affected can seek qualified incident-response support rather than assuming that removing the extension alone resolves the risk.
The next public developments to watch are Cursor’s explanation of how the package was published, any updated assessment of affected installations, and further guidance about remediation. Anthropic’s next listed release, version 2.1.314, is separate from the altered 2.1.313 package; users should verify the source of any extension update rather than relying only on its displayed name.
Key Questions
Which Claude Code version was tampered with?
The affected package was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public release list went from 2.1.312 to 2.1.314, with no official 2.1.313 entry listed in the source material.
How many Cursor users may have received it?
Cursor said the incident may have affected at most 5,000 users. That is a ceiling in the company’s estimate, not a confirmed count of installations or successful compromises.
What did the modified extension attempt to do?
Researchers said it attempted to collect computer details, add an attacker’s SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts. Cursor said the administrator-level SSH step failed on most Macs and Windows PCs.
What should users do if they find the svc-telemetry key?
The source advises using Cursor’s cleanup scripts; it says uninstalling the extension alone is not enough. It also recommends considering a machine rebuild and changing credentials from a different, trusted computer. Follow Cursor’s official guidance for current, system-specific steps.
Were Anthropic’s official Claude Code channels affected?
Anthropic said its own systems and official channels were not affected. The source also says vendors and researchers reported no impact to Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX or npm; the tampered build was distributed through Cursor’s marketplace.
Source: ThorstenMeyerAI.com
