🔍 Read the full analysis: A Tampered Claude Code Update: What AI Developers Should Check Now on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on Oct. 29 and could have reached up to 5,000 users. The code attempted to collect device information and establish persistent remote access; Cursor and Anthropic say their own systems were not compromised. Cursor users should check for the SSH key labelled svc-telemetry and follow Cursor’s cleanup guidance if it is present.
A tampered Claude Code extension was available in Cursor’s extension marketplace for about 11 hours on Oct. 29, Cursor said, potentially affecting up to 5,000 users. The modified version, numbered 2.1.313, used the genuine extension name and identifier but was not built by Anthropic; its code attempted to establish persistent access to affected computers.
Cursor says the version was listed from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC). The company removed it after detection, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor said it audited access, rotated marketplace keys, rebuilt the marketplace and brought it back online. It has not publicly explained how the modified build was published under Anthropic’s extension identity.
Security researchers described a loader placed ahead of the extension’s normal code. It ran when the editor loaded the extension, without requiring a user to open Claude Code or approve a separate prompt. According to Cursor and researchers, the code gathered information about the computer, added an attacker’s SSH public key, attempted to enable remote login, opened a connection to an external server and added startup mechanisms intended to persist after a restart.
Cursor said the attempt to enable SSH required administrator privileges and failed on most Macs and Windows PCs. That limited one route to remote login, but does not establish that every attempted action failed: Cursor and researchers said the key, startup entries and a data report could still be written. Cursor also said the attacker’s server was offline. The incident affects the Cursor marketplace listing, not every way of obtaining Claude Code: Anthropic’s official release history went from 2.1.312 to 2.1.314, and the source material says versions from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
A Trusted Extension Channel Was Abused
The incident matters because the malicious code arrived as an update to a listing developers already recognized, rather than as an obvious copy with a different name. Users with automatic extension updates may have received it without taking an action beyond using Cursor. That makes this a software supply-chain incident: a familiar distribution channel delivered code that its displayed identity did not reliably authenticate.
Code editors can access project files and developer tools while running. That makes a compromised extension a potential exposure for source code, local files and credentials, even if the remote-login step does not succeed. Cursor’s estimate of up to 5,000 users is a ceiling reported by the company, not a confirmed count of infected or compromised machines. The available statements also do not establish that attackers successfully used the access they attempted to create.
For developers, the practical distinction is between removing the extension and checking whether it changed the system. Cursor’s guidance, as summarized in the source material, calls for looking for a key labelled svc-telemetry and using its cleanup scripts if found. Researchers and Cursor advise considering a system rebuild and changing credentials from a separate, trusted device when there are signs of compromise.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Update and Its Distribution Window
Anthropic’s published Claude Code release immediately before the incident was 2.1.312, released on Oct. 27, according to the source material. Cursor’s marketplace then offered the modified 2.1.313 build on Oct. 29. Anthropic released 2.1.314 on Oct. 30; the source’s check of Anthropic’s public release list found no official 2.1.313 entry.
Cursor’s notice said the extension was removed and the marketplace was taken offline as a precaution. Early reports incorrectly identified Open VSX as the distribution source and were corrected, according to the source account. Cursor said the affected listing was in its own marketplace. Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic systems or employee laptops. The public accounts do not agree on who first detected the build: Cursor says it identified the issue, while reports and researchers describe other possible alerts.
Researchers cited in the source include Phorion and OpenSourceMalware. Their analyses describe the extension’s behavior, while statements about the affected user ceiling, takedown and marketplace response come from Cursor. Those distinctions matter: a security analysis can identify what code attempted, but does not by itself confirm how many machines were affected or whether an attacker used any access.
“impacting at most 5,000 users”
— Cursor
How the Listing Was Published
The route used to publish the tampered build remains unexplained. Cursor has not said how it appeared under Anthropic’s name and genuine extension identifier. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the source material does not provide further detail about the access or how it was obtained.
The number of users who actually installed or ran the extension is also unknown. Cursor’s figure is an estimate of up to 5,000 potentially affected users, and the public information does not specify how many devices had the SSH key or startup entries added. It is not clear whether any attacker successfully connected to a device or accessed files, credentials or source code. The reported failure of the administrator-dependent SSH step on most Macs and Windows PCs does not answer whether other parts of the code ran on particular machines.
The public record also leaves open who first spotted the incident and when every marketplace response step occurred. Cursor has described its actions but has not published timestamps for the audit, key rotation, rebuild or restoration of the store.
Check Devices and Follow Cursor’s Guidance
Cursor users who had Claude Code installed during the distribution window should check for an SSH key labelled svc-telemetry, using the vendor’s published instructions. If it is present, uninstalling the extension alone may not remove changes the code made. Cursor’s cleanup scripts are the stated next step; users should also consider rebuilding the machine and changing relevant credentials from a separate, trusted computer, particularly if the device contains sensitive repositories or access tokens.
Users should confirm which distribution source they used before treating their installation as affected. The source material says the modified build was in Cursor’s marketplace, not the Microsoft Visual Studio Marketplace, Open VSX or npm. Anyone uncertain about their installation should consult Cursor’s current security notice rather than rely on early reports that named a different marketplace.
Further reporting depends on Cursor explaining how the listing was published and whether its investigation identifies confirmed device compromises or data access. Until those details are released, the distinction between an attempted backdoor and successful attacker access remains important.
Key Questions
Which Claude Code version was tampered with?
The affected Cursor marketplace listing was version 2.1.313. Anthropic’s public release list went from 2.1.312 to 2.1.314, according to the source material.
Was Anthropic’s own system compromised?
Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. The modified build was distributed through Cursor’s marketplace.
How can Cursor users check for the reported change?
Check for an SSH public key labelled svc-telemetry, following Cursor’s security instructions. If it is present, Cursor’s cleanup guidance is needed; uninstalling the extension alone may not undo system changes.
Did the malware successfully give attackers remote access?
That has not been confirmed. Cursor said enabling SSH required administrator rights and failed on most Macs and Windows PCs, and that the attacker’s server was offline. Public information does not establish whether an attacker connected to any affected machine.
Were other Claude Code distribution channels affected?
The source material says the affected build was in Cursor’s marketplace and that Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected. Early reports naming Open VSX were corrected.
Source: ThorstenMeyerAI.com
