🔍 Read the full analysis: A Tampered Update Using The Claude Code Name Reached Cursor Users on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A tampered version of Anthropic’s Claude Code extension was distributed through Cursor’s extension marketplace on October 29, according to Cursor and security researchers. Cursor says at most 5,000 users may have been affected; how the build appeared under Anthropic’s extension identity has not been explained.
A tampered Claude Code extension was available through Cursor’s extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users, Cursor says. The version, numbered 2.1.313, used Anthropic’s extension name and identifier but was not built by Anthropic, according to Cursor and security researchers; it attempted to establish persistent access to affected computers.
Cursor said the modified extension was available from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. The package appeared under the identifier anthropic.claude-code, and Cursor named modified builds for Apple-silicon Macs and 64-bit Windows. The company said it removed the version after detecting it, blocked further distribution, and temporarily shut down its VS Code extension marketplace while it reviewed access and rebuilt the service.
Analyses by security firms Phorion and OpenSourceMalware, as described in the source reporting, found a loader placed ahead of the extension’s normal code. It ran when the editor loaded the extension, without requiring the user to open Claude Code or click a prompt. The researchers said the code collected information about the computer, added an attacker-controlled SSH public key, attempted to enable remote login and open a tunnel to an outside server, and added ways to persist after restarts.
Cursor said the SSH-enabling step required administrator privileges and failed on most Macs and Windows computers. That limited the attacker’s ability to log in through the tunnel on those machines, but did not mean no changes occurred: according to the source material, the key, startup entries and a report of collected data could still have been placed or sent. The attacker’s server was reported to be offline. Cursor said it would contact affected users directly.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
A Trusted Extension Channel Was Abused
The incident matters because the modified build appeared as an update to the legitimate extension listing, rather than as an obvious copycat with a slightly different name. Users who had automatic extension updates enabled could have received it without taking an action specific to this release, according to security researcher Jenn Gile, quoted by The Hacker News.
Code editors can grant extensions access to local files, source code and developer tools. An extension distributed through a trusted store can therefore expose valuable development material and provide a route toward unauthorized access. In this case, the reported failure of the administrator-dependent SSH step on most machines reduced one part of the threat, but it does not establish that every affected computer was safe or that the other attempted actions failed.
The episode also puts attention on the security of software marketplaces and publishing controls. A familiar publisher name and identifier do not, by themselves, establish that a particular build came from that publisher. The source material does not establish whether any data was misused, whether an attacker successfully logged in, or how many users actually installed the package.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Amazon Kindle Scribe Colorsoft 64GB (1st Generation)
As an affiliate, we earn on qualifying purchases.
The Version and Distribution Timeline
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no official 2.1.313 release listed when checked on October 30, according to the supplied source material. The affected 2.1.313 was distributed through Cursor’s marketplace, not identified as an Anthropic-built release. Anthropic said its own systems and employee laptops were not compromised.
Cursor said it removed the package and took its VS Code marketplace offline as a precaution, then audited access, rotated keys, rebuilt the marketplace and restored it. The source material says Cursor did not publish the times for those recovery steps. Early reports that named the Open VSX marketplace were corrected; the supplied reporting says the affected distribution channel was Cursor’s marketplace, and says the Claude Code offerings from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected.
Public accounts differ on who first detected the tampering: Cursor said its team identified it, The Register credited Phorion with first spotting it, and OpenSourceMalware thanked a developer who alerted the group. The available information does not settle that sequence.
““impacting at most 5,000 users””
— Cursor
How the Fake Build Was Published
The central unanswered question is how the modified package was published under Anthropic’s extension identity. Cursor has not explained the publishing path or said whether the incident involved compromised credentials, a marketplace weakness or another method. Anthropic said a malicious actor “used access to Cursor’s marketplace” and that its own systems were not compromised, but the supplied material does not provide further detail about that access.
It is also not yet clear how many users installed or ran the package, what information was successfully collected, or whether any attacker gained access to a computer. Cursor’s figure of at most 5,000 users is an upper estimate, not a confirmed impact total. The reported server being offline and the SSH step failing on most machines do not resolve whether data was accessed or retained elsewhere.
Checks for Cursor Claude Code Users
Cursor said it would contact affected users directly. Users of Claude Code through Cursor should follow Cursor’s published incident guidance and check for the SSH key label svc-telemetry, as directed in the supplied source material. If it is present, uninstalling the extension alone may not remove other changes: Cursor’s cleanup scripts are recommended, and rebuilding the machine may be appropriate depending on the situation.
Anyone who finds the key or otherwise suspects exposure should change credentials from a different, trusted computer, rather than relying only on removing the extension from the potentially affected machine. Cursor has not publicly provided a final count of affected users or a full explanation of how the package entered its marketplace. Those details, along with any further findings from the companies’ investigations, remain the next developments to watch.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version numbered 2.1.313 was distributed through Cursor’s extension marketplace on October 29. Cursor and researchers said it was not built by Anthropic and attempted to collect system details and establish persistent access.
How many users may have received the tampered update?
Cursor said the incident may have affected at most 5,000 users. That is a maximum estimate; the confirmed number of installations or affected machines has not been provided.
Was Anthropic’s own system compromised?
Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. The supplied information does not explain how the package was published under Anthropic’s extension identity in Cursor’s marketplace.
What should Cursor users check?
Users who installed Claude Code through Cursor should consult Cursor’s incident guidance and check for the SSH key label svc-telemetry. If found, follow Cursor’s cleanup instructions; changing credentials from a separate, trusted computer is also advised in the supplied source material.
Were Claude Code downloads from other sources affected?
The supplied reporting says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected. Early reports naming Open VSX were corrected.
Source: ThorstenMeyerAI.com
