🔍 Read the full analysis: Cursor Users: Review These Signs Of A Tampered Claude Code Update on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A tampered version of Anthropic’s Claude Code extension, version 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. The company says up to 5,000 users may have received it; users should check for an SSH key labelled svc-telemetry and follow Cursor’s cleanup guidance if it is present.
Cursor says a tampered Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially reaching as many as 5,000 users. The modified version, numbered 2.1.313, used Anthropic’s extension name and identifier but was not developed by Anthropic, according to Cursor and security researchers.
Cursor said the version was available from approximately 2:27 a.m. to 1:35 p.m. Pacific time on October 29. The company removed it after detection, blocked further distribution and temporarily shut down its VS Code extension marketplace while it reviewed access, rotated keys and rebuilt the marketplace. Cursor said it would contact users who may have been affected. It has not publicly explained how the modified package was published under Anthropic’s extension identity.
Researchers said the package placed a small malicious loader ahead of the extension’s normal code. It ran when the extension loaded in Cursor, without requiring a separate click. According to the analyses cited in the source reporting, the code collected information about the computer, attempted to add an attacker-controlled SSH key, enable remote login and create a network tunnel to an attacker’s server. It also included steps intended to persist after restarts.
The SSH access step required administrator privileges. Cursor said that attempt failed on most Macs and Windows computers, limiting the attacker’s ability to log in through the tunnel on those machines. The attacker’s server is now offline, according to the source material. Those details do not establish that every other action failed: researchers reported that the key, startup entries and a system-data report could still be written or transmitted.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Need Scrutiny
The incident shows how a compromised software distribution channel can put a malicious package in front of users who believe they are updating a trusted tool. Because the version appeared under the real extension name and identifier, it was not simply a separate imitation with a misspelled title. Users with automatic updates enabled may have received it without choosing to install a new extension, according to Jenn Gile, co-founder of OpenSourceMalware, in comments reported by The Hacker News.
Code editors can grant extensions access to local files, source code and developer tools. That makes an extension compromise relevant beyond the editor itself: a developer’s machine may contain credentials or access to software projects and other systems. The reported SSH and persistence attempts are particularly serious because they were designed to create a route back into an affected computer. However, the available account does not confirm that attackers successfully gained remote access to every, or any, affected machine.
Cursor’s estimate of up to 5,000 potentially affected users is a maximum figure, not a confirmed count of infected devices or successful intrusions. The difference matters: having downloaded the version, having run its code and having an attacker successfully accessed a machine are separate outcomes. The public information supplied so far does not quantify how many users fall into each category.
Products Worth Considering
Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
The Missing 2.1.313 Release
Anthropic’s official release history provides a useful comparison. The source material says the company published Claude Code 2.1.312 on GitHub on October 27, then released 2.1.314 on October 30. Its public list skipped version 2.1.313. Anthropic staff member Felix Rieseberg said the event was not a compromise of Anthropic’s systems or employee laptops. Anthropic also said its official channels were not affected.
The distinction between distribution channels prompted some confusion after the incident. Early reports named Open VSX, but those reports were corrected, according to the source material. The affected package was distributed through Cursor’s VS Code extension marketplace. The source says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected, based on vendor statements and researchers’ findings.
Cursor said it removed the malicious version and temporarily took its marketplace offline as a precaution. It later audited access, rotated marketplace keys, rebuilt the service and brought it back online. The exact timing of those operational steps was not provided in the source material.
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
— Jenn Gile, co-founder of OpenSourceMalware, speaking to The Hacker News
How the Package Reached Cursor
The central unresolved question is how the modified build was published under Anthropic’s extension identity. Cursor has not publicly described the route used to upload or authorize it. Anthropic said a malicious actor “used access to Cursor’s marketplace,” according to the source material, but that wording does not explain whether marketplace credentials, a publishing process or another mechanism was involved.
It is also unclear how many users actually installed or ran version 2.1.313, whether any machines were successfully accessed remotely, and what data—if any—was received by the attacker. Cursor’s maximum exposure estimate does not answer those questions. The source material also gives differing accounts of who first detected the incident: Cursor said it identified it, while reporting and researchers credited Phorion or a developer who alerted OpenSourceMalware. The public record does not settle that point.
Researchers and Cursor reported that the attacker’s server was offline, but the available information does not establish who operated it or whether other infrastructure was involved. These details may change as Cursor, Anthropic and security researchers publish further findings.
Check for the SSH Key
Cursor users who installed Claude Code through Cursor should check for a key labelled svc-telemetry, as directed in Cursor’s guidance. If it is present, the source material says uninstalling the extension alone is not enough: users should use Cursor’s cleanup scripts, consider rebuilding the affected computer and change credentials from a separate, trusted device. The advice is specific to the reported incident; users should follow Cursor’s published instructions for the detailed procedure.
Users who do not find that key should still verify which extension version they received and review Cursor’s incident notice for updates. Cursor said it would contact potentially affected users directly. The next public developments to watch for are Cursor’s explanation of how the package entered its marketplace, more detail about its affected-user count and any further findings on whether the attempted access succeeded.
Key Questions
Was the tampered extension an official Anthropic release?
No. Cursor said version 2.1.313 was not developed by Anthropic, despite using the extension’s name and identifier. Anthropic said its own systems and official channels were not affected.
How long was version 2.1.313 available?
Cursor said it was available in its marketplace from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29, 2026, roughly 11 hours.
Does Cursor’s estimate mean 5,000 computers were compromised?
No. Cursor’s statement was that at most 5,000 users may have been affected. That is not a confirmed count of devices infected or machines successfully accessed by an attacker.
What should a Cursor user check?
Check for an SSH key labelled svc-telemetry, following Cursor’s incident guidance. If it is present, Cursor’s cleanup steps may require more than removing the extension; the source material advises using the cleanup scripts, considering a rebuild and changing credentials from a trusted device.
Were other Claude Code distribution channels affected?
The source material says the versions distributed through Microsoft’s Visual Studio Marketplace, Open VSX and npm were not affected. Early reports naming Open VSX were corrected.
Source: ThorstenMeyerAI.com
