🔍 Read the full analysis: What Cursor Users Can Learn From The Tampered Claude Code Update on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on Oct. 29, according to Cursor. Cursor says up to 5,000 users may have been affected; the code attempted to collect device information and establish persistent remote access. The companies have not explained how it was published under Anthropic’s extension identity.
A tampered Claude Code extension was available in Cursor’s VS Code extension marketplace for about 11 hours on Oct. 29, and Cursor says up to 5,000 users may have received it. The version, numbered 2.1.313, appeared under Anthropic’s extension name and identifier but was not built by Anthropic, according to Cursor and security researchers; it attempted to collect device details and set up persistent remote access.
Cursor said the modified extension was available from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC). The company said it removed the version after detecting it, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor said it audited access, rotated marketplace keys, rebuilt the marketplace and restored it. It has not published a detailed account of how the modified build entered the store.
Researchers reported that a small loader ran when the editor loaded the extension, without requiring a user to open Claude Code or approve a separate action. The code attempted to gather information about the computer, add an attacker-controlled SSH public key, enable remote login, create a tunnel to an attacker server and persist through restarts. OpenSourceMalware described a 66-line block placed before the extension’s legitimate code.
Cursor said the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That would limit remote access through the tunnel on those machines, but it does not mean the other attempted actions failed. Cursor’s response advises affected users to check for an SSH key labelled svc-telemetry. The company says uninstalling the extension alone may not remove changes already made.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Need Verification
The incident shows how a trusted software distribution channel can be abused: the malicious package reportedly appeared as an update to the real extension listing, rather than as a separate copy with a misspelled name. Users with automatic extension updates could have received it without deliberately installing a new product. That makes publisher identity and extension names insufficient on their own to establish that an update is safe.
Developer extensions can run in an environment with access to local files, source code and development tools. A compromised extension can therefore put project material and credentials at risk, even if a particular remote-access step does not work. Cursor’s estimate is an upper bound, not a confirmed count of machines where the code ran or data was accessed. The practical concern is that exposure may have occurred before users knew there was a problem.
For Cursor users, the immediate issue is checking for traces and following remediation guidance. For marketplace operators and software publishers, the unresolved publication route matters because it bears on how extension ownership, release permissions and package integrity are protected. The incident also underlines why a security response should distinguish between an attempted action and a confirmed compromise.
Products Worth Considering
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Missing 2.1.313 Release
Anthropic’s public GitHub release history lists version 2.1.312 before the incident and then version 2.1.314 afterward; it does not list an official 2.1.313 release, according to the source material checked on Oct. 30. Cursor says the maliciously modified build was distributed through its own VS Code extension marketplace. The affected distribution channel matters: early reports that named Open VSX were corrected, and the supplied reporting says the Visual Studio Marketplace, Open VSX and the npm package were not affected.
Cursor’s timeline places the affected build in its marketplace for roughly 11 hours on Oct. 29. On Oct. 30, Cursor publicly described the incident and said at most 5,000 users were affected. Anthropic technical staff member Felix Rieseberg later said the event was not a compromise of Anthropic’s systems or employee laptops. Anthropic released 2.1.314 after the incident; the source material does not establish that this later release alone removes any changes left by the tampered build.
“impacting at most 5,000 users”
— Cursor
How the Listing Was Compromised
The public accounts do not explain how the attacker published a modified build under Anthropic’s extension identity in Cursor’s marketplace. Cursor has not described the access path or named a responsible party. Anthropic said a malicious actor used access to Cursor’s marketplace and said its own systems were not compromised; the source material does not include evidence that identifies how that access was obtained.
It is also unclear how many users actually installed or ran version 2.1.313, which devices had administrator permissions, whether any data was transmitted successfully, or whether a machine was accessed through the tunnel. Cursor’s figure of at most 5,000 is not a confirmed count of infections or successful intrusions. The source material says the attacker’s server is now offline, but that does not establish whether information was collected while it was active.
Who first detected the incident is also disputed or not settled in the public record. Cursor says it identified the issue, while reporting and researchers have credited different parties with spotting or reporting it. These gaps may be addressed in later company disclosures or investigations.
Checks and Remediation for Users
Cursor users who installed Claude Code through Cursor during the affected window should follow Cursor’s security notice and run its check for an SSH key labelled svc-telemetry. If the key is present, Cursor’s guidance says to use its cleanup scripts; removing the extension by itself may not undo system changes. Users should consider rebuilding an affected machine and change credentials from a separate, trusted computer, particularly if sensitive accounts or repositories were accessible.
Cursor says it will contact affected users directly, but the source material does not provide a completion date or describe exactly how recipients will be identified. Users should consult Cursor’s current security guidance rather than rely on an old copy of the extension or an unofficial cleanup tool. The next major development is likely to be a fuller account of how the package was published and what the investigation found about affected users and data exposure.
Key Questions
Which Claude Code version was tampered with?
Cursor says the affected build was version 2.1.313, distributed through its VS Code extension marketplace on Oct. 29. Anthropic’s public release list went from 2.1.312 to 2.1.314, without an official 2.1.313 entry.
Were all Claude Code installations affected?
No. The source material identifies the affected distribution as Cursor’s extension marketplace. It says the Visual Studio Marketplace, Open VSX and the npm package were not affected; early reports naming Open VSX were corrected.
What should Cursor users check?
Users who installed or updated the extension during the affected period should follow Cursor’s security notice and check for an SSH key labelled svc-telemetry. If it is present, Cursor says to use its cleanup scripts; uninstalling the extension alone may not be enough.
Does the incident prove that attackers accessed user machines?
No. The code attempted to create remote access, but Cursor said the step that enabled SSH failed on most Macs and Windows computers because it required administrator privileges. The source material does not establish how many machines were successfully accessed or whether data was taken.
How did the tampered build get into Cursor’s marketplace?
That remains unclear. Cursor has not explained how the build was published under Anthropic’s extension identity. Anthropic said its own systems were not compromised and referred to a malicious actor using access to Cursor’s marketplace.
Source: ThorstenMeyerAI.com
