🔍 Read the full analysis: Claude Code Update With Tampered Code Reached Up To 5,000 Cursor Users on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A tampered version of Anthropic’s Claude Code extension, numbered 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on October 29. Cursor says up to 5,000 users may have been affected; the code attempted to collect device details and establish remote access, though a required administrator-level step reportedly failed on most Macs and Windows PCs. The companies have not explained how the build was published under Anthropic’s extension identity.
Cursor said the modified extension was available from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It removed the version after detecting the incident, blocked further distribution and temporarily shut down its VS Code extension marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor later said the incident could have affected at most 5,000 users and that it would contact them directly.
Security researchers said a small malicious loader had been inserted ahead of the extension’s normal code. It ran when the editor loaded the extension, without requiring a user to open Claude Code or click a prompt. The code attempted to collect information about the computer, add an attacker-controlled SSH public key, enable remote login and create a tunnel to an attacker’s server. Researchers also reported mechanisms intended to persist across restarts.
Cursor and researchers said enabling SSH required administrator privileges. Cursor said that step failed on most Macs and Windows PCs, limiting the ability to use the tunnel to log in on those machines. That does not establish that every other operation failed: the key, startup entries and a data report were still created or sent, according to the source material. The attacker’s server was reported to be offline. Cursor advised users to check for a key labelled svc-telemetry; if found, removing the extension alone is not sufficient, and cleanup steps may be needed.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
A Trusted Extension Channel Was Abused
The incident matters because the modified package appeared as an update to the real Claude Code listing, using its extension identity, rather than as an obvious copycat with a misspelled name. Users with automatic updates enabled could have received it without taking a separate action. That makes the episode a software supply-chain risk: a familiar distribution channel and publisher label do not, on their own, prove that a particular build is authentic.
Developer extensions can operate alongside source code, local files and other tools available to the editor. A compromised extension can therefore create risks beyond the extension itself, including exposure of development materials or access credentials. The reported failure of the SSH step on most affected computers may have limited one part of the attack, but it does not establish that every device was safe or that no information was collected.
The stated ceiling of 5,000 potentially affected users is not a confirmed count of infections or successful remote logins. Cursor said it would contact affected users, but the published material does not give a final number of installations, machines with the SSH change, or users whose data was accessed.
Products Worth Considering
Withings BPM Connect Smart Blood Pressure Monitor
Withings BPM Vision Blood Pressure Monitor with Wi-Fi and Bluetooth
Hyperice Normatec 3 Leg Compression Boots, Standard Size
As an affiliate, we earn on qualifying purchases.
What Is Known About the Release
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no official 2.1.313 release listed, according to the source material checked on October 30. The tampered 2.1.313 build was distributed through Cursor’s VS Code extension marketplace, not presented as an official Anthropic release. Anthropic released version 2.1.314 on October 30.
Cursor’s notice and the security analyses cited in the report identify Cursor’s marketplace as the affected distribution route. The report says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected, and that early accounts naming Open VSX were corrected. The incident was therefore specific to the Cursor marketplace listing described by the sources, rather than evidence that every Claude Code distribution was compromised.
Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. Cursor said it audited marketplace access, rotated keys and rebuilt the marketplace before restoring it. The public account does not identify how the altered version was submitted or approved under the extension’s identity.
“The modified extension was impacting at most 5,000 users.”
— Cursor
How the Build Entered Cursor’s Store
The central unresolved issue is how the modified build was published under Anthropic’s extension name and identifier. Cursor has not publicly explained the submission path or whether an account, publishing credential or marketplace process was abused. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available material does not detail that access or identify the actor.
The number of users who actually installed the version, the number of devices where the SSH-related changes succeeded, and whether any user data was accessed remain unclear. Cursor’s figure is an upper estimate of potential impact. The source material also gives conflicting accounts about who first detected the incident: Cursor said it identified it, while reporting credited security researchers and a developer alert. No definitive public timeline resolves that point.
Cursor said the attacker’s server was offline, but the cited material does not provide an independent assessment of what information, if any, reached it before it went offline. Nor does it confirm that every affected machine received or executed all parts of the code.
Checks for Cursor Claude Code Users
Cursor said it would contact affected users directly. Users who installed or updated Claude Code through Cursor during the exposure window should check Cursor’s security notice and follow its cleanup guidance. The report specifically recommends checking for an SSH key labelled svc-telemetry. If that key is present, uninstalling the extension is not enough; users should use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer.
Cursor’s marketplace has been rebuilt and restored, according to the source material, but the public account does not include a complete technical explanation of how the listing was altered. Further updates from Cursor or Anthropic may clarify the publishing route, the confirmed number of affected installations and whether investigators found evidence that data was accessed. Until then, the maximum user estimate should not be treated as a confirmed breach count.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version, 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29. Cursor said it was not built by Anthropic and could have reached up to 5,000 users.
Did Anthropic’s systems get compromised?
Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. How the altered build reached Cursor’s marketplace remains unexplained publicly.
Could the extension access a computer without a click?
Researchers said the loader ran when the editor loaded the extension, without a separate click. It attempted several actions, including collecting computer details and changing SSH access settings. Cursor said the administrator-level SSH step failed on most Macs and Windows PCs.
How can users check whether they may be affected?
Users who installed Claude Code through Cursor during the October 29 exposure window should check Cursor’s notice and look for an SSH key labelled svc-telemetry. If found, the source recommends using Cursor’s cleanup scripts, considering a machine rebuild and changing credentials from a trusted device.
Were other Claude Code distribution channels affected?
The source material says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. The reported exposure involved the Cursor extension marketplace; early reports naming Open VSX were corrected.
Source: ThorstenMeyerAI.com
