🔍 Read the full analysis: Claude Code’s Name Was Right, But The Update Wasn’t: Next Steps on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was distributed through Cursor’s extension marketplace for about 11 hours on October 29. Cursor says up to 5,000 users may have been affected; the code attempted to collect system details and establish remote access. The publication path remains unexplained, and Cursor advises affected users to check for a specific SSH key and follow its cleanup guidance.
Cursor’s extension marketplace distributed a tampered version of Anthropic’s Claude Code extension for about 11 hours on October 29, Cursor said, warning that up to 5,000 users may have received it. The build, version 2.1.313, used the official extension’s name and identifier but was not developed by Anthropic, according to Cursor and security researchers.
The altered extension was available from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC), according to Cursor. It was distributed through Cursor’s VS Code extension marketplace. The company said it removed the version after detecting the incident, blocked further distribution and temporarily shut down the marketplace while it reviewed access, rotated keys and rebuilt the service. Cursor has not published the timing of each response step.
Researchers said the package included a small loader before the extension’s legitimate code. It ran when the editor loaded the extension, without requiring a user to open Claude Code or approve a separate prompt. The code attempted to collect information about the computer, add an attacker-controlled SSH public key, enable remote login, open a tunnel to an attacker’s server and maintain access after restarts.
Cursor said enabling SSH required administrator privileges and that this step failed on most Macs and Windows PCs. That limited one route to remote access, but researchers said the key, startup entries and a report of collected information could still be left on a machine. Cursor said the attacker’s server is now offline. It advised users to check for an SSH key labelled svc-telemetry; simply uninstalling the extension may not remove the changes.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
How the Marketplace Update Could Reach Users
The incident is a software supply-chain risk: users could receive harmful code through an extension listing they believed was legitimate. Because the modified version carried the expected name and extension identifier, the familiar listing itself would not distinguish it from an authentic Anthropic release. Users with automatic extension updates may have received it without taking an action at the time, according to security researchers cited by The Hacker News.
For developers, the potential exposure extends beyond the editor. An extension can operate in a local development environment with access to files, source code and developer tools available to the user. Cursor’s estimate of up to 5,000 users is a maximum, not a confirmed count of machines where the malicious code ran or where an attacker obtained access. The reported failure of the SSH step on most systems also does not establish that every other attempted action failed.
The event also leaves questions about the integrity of extension marketplaces and their publisher controls. Cursor says the affected version was removed and that it rebuilt its marketplace, but it has not publicly explained how the package was published under Anthropic’s identity. Until that route is clarified, the incident’s precise cause and scope remain unsettled.
Products Worth Considering
Apple Watch SE 3 GPS 44mm Smartwatch
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
Apple Watch Series 12 GPS Smartwatch, 46mm
As an affiliate, we earn on qualifying purchases.
The Version Gap and Vendor Responses
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 entry, according to the release list checked on October 30. Version 2.1.312 was published on GitHub on October 27; Anthropic released 2.1.314 on October 30. The suspicious 2.1.313 appeared in Cursor’s marketplace during the intervening period.
Cursor said the affected listing was its VS Code marketplace and that the modified builds named in its notice were for Apple-silicon Macs and 64-bit Windows. Anthropic said its own systems were not compromised and that its official distribution channels were unaffected. The source material also says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports that identified Open VSX as the source were corrected.
Security firms Phorion and OpenSourceMalware published analyses on October 30, and Reuters reported Cursor’s estimate. Public accounts differ on who first detected the incident: Cursor said it identified it, The Register credited Phorion with spotting it, and OpenSourceMalware thanked a developer who alerted the firm. The available reporting does not settle that sequence.
““impacting at most 5,000 users””
— Cursor
What the Incident Record Still Lacks
How the altered package entered Cursor’s marketplace is not publicly explained. Cursor has not described the account, process or security control involved, while Anthropic has said a malicious actor used access to Cursor’s marketplace. The public record also does not establish who first detected the package or provide a confirmed number of installations and compromised machines.
Cursor’s estimate of up to 5,000 users does not show how many devices executed the code, what information was successfully collected, or whether any systems were accessed through a method other than the SSH route. The vendor says the attacker’s server is offline and that SSH activation failed on most Macs and Windows PCs, but those statements do not determine the condition of every potentially affected device. No public account in the source material identifies a specific victim or confirms data theft.
Checks and Cleanup for Cursor Users
Users who installed or updated Claude Code through Cursor’s marketplace during the affected window should follow Cursor’s incident guidance. The stated check is to look for an SSH key labelled svc-telemetry. If it is present, Cursor says uninstalling the extension alone is not enough: users should use the company’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer.
Cursor has said it will contact affected users directly, but the source material does not give a schedule or explain how it will identify every potentially exposed account. Users should consult Cursor’s security notice for current instructions rather than rely on extension removal alone. The next significant public developments would be a fuller account of how the package was published, any confirmed findings about the number of affected installations, and further guidance from Cursor or Anthropic.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 appeared in Cursor’s VS Code extension marketplace on October 29. Cursor said the build was not developed by Anthropic and was available for about 11 hours.
How many users may have received the extension?
Cursor said at most 5,000 users may have been affected. That is a maximum estimate; the source material does not provide a confirmed count of installations or devices where the code ran.
What should a potentially affected user check?
Cursor advised checking for an SSH key labelled svc-telemetry. If it is present, its guidance says to use the cleanup scripts, consider rebuilding the machine and change credentials from another trusted computer. Uninstalling the extension alone may not be sufficient.
Was Anthropic’s software or infrastructure compromised?
Anthropic said its own systems were not compromised and that its official channels were unaffected. The reported incident involved a modified extension distributed through Cursor’s marketplace; the public explanation of how it was published there remains incomplete.
Were other Claude Code distribution channels affected?
The source material says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports naming Open VSX as the source were corrected.
Source: ThorstenMeyerAI.com
