🔍 Read the full analysis: A Tampered Claude Code Update Reached Cursor—Start With These Checks on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on Oct. 29, according to Cursor. The company estimates up to 5,000 users may have been affected and says it will contact them; users should check for an SSH key labelled svc-telemetry and follow Cursor’s cleanup guidance if it appears.
Cursor says a tampered Claude Code extension was available in its marketplace for about 11 hours on Oct. 29, potentially reaching up to 5,000 users. The modified version, numbered 2.1.313, carried Anthropic’s extension name and identifier but was not built by Anthropic; Cursor says it removed the release and will contact affected users directly.
According to Cursor, the version was available from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC). It was distributed through Cursor’s VS Code extension marketplace under the identifier anthropic.claude-code, rather than as a separate look-alike listing. Users with automatic extension updates could have received it without taking an action, security researchers told The Hacker News.
Analyses by security firms Phorion and OpenSourceMalware describe a loader placed before the extension’s legitimate code. The malicious component reportedly ran when the editor loaded the extension and attempted to collect computer details, add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and establish persistence across restarts. Cursor says enabling SSH required administrator privileges and failed on most Macs and Windows PCs. The attacker’s server is now offline, according to the source material, but that does not establish that every other action failed.
Cursor removed the release, blocked further distribution, temporarily shut down its VS Code marketplace, audited access, rotated keys and rebuilt the marketplace, according to its notice. Anthropic says its own systems were not compromised and that its official distribution channels were unaffected. The source material says the affected release was not available through Microsoft’s Visual Studio Marketplace, Open VSX or the npm package; early reports identifying Open VSX were corrected.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Matter
The incident shows the risk of trusting an extension update solely because it appears under a familiar name and identifier. Here, the reported malicious build reached users through Cursor’s distribution channel as an update to the established listing. Automatic updates could have delivered it without a separate download or a user clicking a suspicious link.
For developers, the possible exposure matters because editor extensions can access local files, source code and developer tools while loaded. The described attempt to install an SSH key and create a remote connection could have put machines and credentials at risk if those steps succeeded. Cursor says the SSH-enabling step failed on most Macs and Windows PCs, but users should not treat that as confirmation that their own machines were unaffected. The up-to-5,000 figure is Cursor’s estimate, not a confirmed count of compromised devices.
The case also puts pressure on marketplace safeguards: the public record described in the source does not explain how an unauthorized build appeared under Anthropic’s identity. Cursor’s takedown and marketplace rebuild address distribution, while checks on individual machines are needed to determine whether the extension left traces or changed access settings.
Popular right now
Ninja DualZone Air Fryer 10 Qt Smart 6-in-1 Grey (DZ950)
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Shark HydroVac MessMaster Corded Wet/Dry Vacuum, Mop & Self-Clean (WD161)
As an affiliate, we earn on qualifying purchases.
How Version 2.1.313 Appeared
Anthropic’s public GitHub release list went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 entry, according to a check cited in the source material on Oct. 30. Version 2.1.312 had been published on Oct. 27. Anthropic released 2.1.314 on Oct. 30, after the affected Cursor marketplace version had been removed.
Cursor said the modified build was available for Apple-silicon Macs and 64-bit Windows systems. The company’s notice says it removed the version upon detection and later took its entire VS Code marketplace offline as a precaution, before auditing access, rotating keys and rebuilding the service. Public accounts differ on who first detected the incident: Cursor says it identified it, The Register credited Phorion, and OpenSourceMalware thanked a developer who alerted the group. The available reporting does not settle that timeline.
Anthropic technical staff member Felix Rieseberg wrote on Oct. 30 that the incident was not a compromise of Anthropic’s systems or employee laptops. That statement addresses Anthropic’s own environment; it does not establish whether a particular Cursor user installed or was affected by the modified extension.
“The modified extension impacted at most 5,000 users.”
— Cursor
What User Exposure Is Known
Cursor has not published a count of users who actually installed or loaded version 2.1.313, nor a confirmed count of machines where the attempted actions succeeded. Its maximum estimate of 5,000 potentially affected users should not be read as proof that all those users received the extension or that their computers were compromised.
The route by which the modified package entered Cursor’s marketplace also remains unexplained in the source material. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not publicly described how the attacker published under Anthropic’s extension identity. The full scope of data collected, if any, and whether any attacker-controlled access was successfully used are also not established in the cited accounts.
Users should verify their own systems rather than rely only on statements about administrator permissions or the now-offline server. Those details reduce some risk but do not show whether the extension wrote files, reported device information or left other changes behind.
Checks Cursor Users Should Run
Cursor users who installed or updated Claude Code through its marketplace during the affected window should run Cursor’s check for an SSH key labelled svc-telemetry. The source material says that if the key is present, simply uninstalling the extension is not enough: users should use Cursor’s cleanup scripts and consider rebuilding the machine. They should change relevant credentials from a separate, trusted computer, rather than from a device that may have been affected.
Cursor says it will contact affected users directly. Users should follow the company’s official incident guidance for cleanup and current marketplace status, and avoid relying on unofficial downloads or instructions. Anyone who finds the key or other suspicious changes should preserve relevant information and follow their organization’s security response process.
The next public milestones are further details from Cursor about how the extension was published and any additional findings from its investigation. Until those are provided, the number of installations, the extent of successful access and the full scope of any data exposure remain unresolved.
Key Questions
What was the tampered Claude Code update?
It was version 2.1.313, a modified Claude Code extension distributed through Cursor’s VS Code marketplace on Oct. 29. Cursor says it was not built by Anthropic and was available for about 11 hours.
How can Cursor users check for the reported SSH key?
Run the check Cursor published for a key labelled svc-telemetry. If it is present, Cursor’s guidance, as summarized in the source material, calls for cleanup scripts; uninstalling the extension alone is not enough.
Does the incident mean Anthropic was breached?
Anthropic technical staff member Felix Rieseberg said the incident did not involve a compromise of Anthropic’s systems or employee laptops. The reported tampered build was distributed through Cursor’s marketplace.
Were users of other Claude Code distribution channels affected?
The source material says the modified version was not distributed through Microsoft’s Visual Studio Marketplace, Open VSX or the npm package. Early reports naming Open VSX were corrected.
How many computers were compromised?
That has not been established publicly. Cursor estimates that at most 5,000 users may have been affected, but the source material does not give a confirmed number of installations or compromised machines.
Source: ThorstenMeyerAI.com
