🔍 Read the full analysis: Tampered Claude Code Update Reached Up To 5,000 Cursor Users: What To Check on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A tampered version of Anthropic’s Claude Code extension, numbered 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on Oct. 29. Cursor says up to 5,000 users could have received it; the malicious code attempted to establish remote access and collect system details. Cursor advises affected users to check for an SSH key labeled svc-telemetry and use its cleanup guidance if found.
Cursor says a tampered Claude Code extension was available in its VS Code extension marketplace for about 11 hours on Oct. 29 and could have reached up to 5,000 users. The modified version, listed as 2.1.313 under Anthropic’s extension identity, attempted to collect computer details and set up remote access; Cursor says it removed the build and will contact affected users.
Cursor’s security notice says version 2.1.313 was available from about 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29. The extension carried the name and identifier associated with Anthropic’s Claude Code, but Cursor says the build was not developed by Anthropic. Users with automatic extension updates enabled could have received it without taking action.
Security analyses described a loader placed ahead of the extension’s legitimate code. It ran when the editor loaded the extension and attempted to collect information about the computer, add an attacker-controlled SSH public key, enable remote login, and establish a tunnel to an attacker’s server. Cursor says the SSH-enabling step failed on most Macs and Windows computers because it required administrator privileges. That does not establish that every other attempted action failed.
Cursor says the attacker’s server is now offline. It removed the version, blocked further distribution, and temporarily shut down its VS Code marketplace while it reviewed access, rotated keys, rebuilt the marketplace and restored it. The company said it would contact users who may have received the extension. Anthropic said its own systems were not compromised and that its official distribution channels were unaffected.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Marketplace Listing Matters
The incident shows why an extension’s familiar name and identifier are not enough to establish that a particular build came from its publisher. A malicious update appeared under the established Claude Code listing in a marketplace used by Cursor, rather than as an obvious look-alike with a misspelled name. That could put users at risk even if they did not deliberately install a new, unfamiliar extension.
For developers, an editor extension can operate within a trusted work environment and may access local files, source code and development tools. The attempted SSH changes make this more than a concern about a counterfeit listing: if the remote-access steps succeeded, an attacker could potentially reach the machine later. Cursor says the SSH step generally failed on Macs and Windows PCs, but users should still check for artifacts and follow the vendor’s remediation advice.
Popular right now
Roborock F25 BX Cordless Wet Dry Vacuum Mop
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Dyson Cyclone V10 Origin Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How Version 2.1.313 Reached Cursor
The affected listing was in Cursor’s VS Code extension marketplace. The supplied account says the malicious build was available from 09:27 to 20:35 UTC on Oct. 29. Anthropic’s public GitHub release history went from Claude Code 2.1.312 to 2.1.314, with no official 2.1.313 release listed when checked on Oct. 30.
Cursor said it detected the incident, removed the version and took its marketplace offline as a precaution before restoring it after security work. Anthropic technical staff member Felix Rieseberg said the event was not a compromise of Anthropic systems or employee laptops. Early reports that named Open VSX as the distribution source were corrected; the source account identifies Cursor’s marketplace as the affected channel. The supplied material says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected.
“impacting at most 5,000 users”
— Cursor
How the Listing Was Compromised
Cursor has not publicly explained how the modified build was published under Anthropic’s extension identity or who was responsible. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available account does not detail how that access was obtained. The public record also does not establish who first detected the incident.
The 5,000 figure is a maximum estimate of users who may have been affected, not confirmation that all those users received the package or that their computers were successfully accessed. Cursor’s statement that SSH activation failed on most Macs and Windows PCs does not resolve whether information was collected or other steps succeeded on particular machines. The supplied material does not give a confirmed count of infections or disclose the full set of data, if any, sent to the attacker’s server.
Checks Cursor Users Should Run
Cursor users who installed or updated Claude Code through its marketplace around the affected period should follow the company’s security notice and run its check for an SSH key labeled svc-telemetry. If that key is present, Cursor advises that uninstalling the extension alone is not enough: users should use Cursor’s cleanup scripts, consider rebuilding the affected machine, and change credentials from a separate, trusted computer.
Cursor says it will contact users who may have received the build. Users should watch for that notice and for any further remediation instructions from Cursor or Anthropic. The companies have not yet provided a public explanation of how the listing was altered, and the supplied material does not give a date for a fuller incident report.
Key Questions
Which Claude Code version was affected?
The modified version was 2.1.313, listed in Cursor’s marketplace under the Claude Code extension identity. Anthropic’s public release list showed 2.1.312 followed by 2.1.314, with no official 2.1.313 release listed when checked Oct. 30.
How can a Cursor user check for the reported SSH key?
Run the check described in Cursor’s security notice and look for a key labeled svc-telemetry. If it appears, follow Cursor’s cleanup guidance rather than relying on uninstalling the extension alone.
Does Cursor say all 5,000 users were compromised?
No. Cursor said up to 5,000 users could have been affected. That is a maximum potential reach, not a confirmed count of users who received the build or suffered successful remote access.
Were Anthropic’s official channels affected?
Anthropic said its own systems and official channels were not compromised. The affected distribution route identified in the supplied account was Cursor’s extension marketplace; Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and npm was reported as unaffected.
What remains unknown about the incident?
The public information does not explain how the attacker published the altered build under Anthropic’s extension identity, how many users actually received it, or whether the attempted data collection succeeded on individual machines.
Source: ThorstenMeyerAI.com
