TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29, 2026, and may have reached at most 5,000 users. The code attempted to collect system details and establish persistent remote access; Cursor says the remote-login step failed on most Macs and Windows PCs. The companies have not explained how the build was published under Anthropic’s extension identity.
Cursor said a tampered version of Anthropic’s Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially reaching at most 5,000 users. The build, version 2.1.313, attempted to gather information about users’ computers and create a way for an attacker to connect remotely, making the incident a software distribution security concern for people who installed or updated the extension in Cursor.
According to Cursor, the modified extension was available from 09:27 to 20:35 UTC (2:27 a.m. to 1:35 p.m. Pacific time). It appeared under the real extension identifier, anthropic.claude-code, rather than as a separate listing with a similar name. The source material says the malicious version could run when the editor loaded the extension, without requiring a user to click a prompt.
Security researchers who analysed the code said it attempted to collect computer details, add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts. Cursor said the administrator-level step needed to enable SSH failed on most Macs and Windows PCs. That limits what is known about successful remote access, but does not establish that every attempted action failed: the key, startup entries and a data report were still created, according to the source material. The attacker’s server is now offline, it says.
Cursor said it removed the version after detecting it, blocked further distribution, temporarily shut down its VS Code extension marketplace, audited access, rotated keys and rebuilt the marketplace before restoring it. It also said it would contact potentially affected users directly. Anthropic said its own systems were not compromised and that its official distribution channels were not affected. Its public release list went from version 2.1.312 to 2.1.314, with no 2.1.313 release listed as of October 30.
Security briefing · October 29, 2026
Was Your Cursor Setup Affected By The Tampered Claude Code Update?
A modified Claude Code extension appeared in Cursor’s marketplace under Anthropic’s genuine extension identity. Here is what is known, what remains uncertain, and what exposed users should check.
01 / What happened
A trusted listing carried an untrusted build
The altered extension was distributed through Cursor’s VS Code extension marketplace. The reported exposure concerns Cursor’s store and update path—not Anthropic’s official distribution channels.
Genuine identifier
The modified version appeared as anthropic.claude-code, rather than as a lookalike extension. It could run when the editor loaded it, without a prompt click.
System details and access
Researchers said the code tried to collect computer details, add an attacker-controlled SSH key, enable remote login, open a server tunnel, and persist across restarts.
Attempt does not prove access
Cursor said the administrator-level SSH step failed on most Macs and Windows PCs. A key, startup entries, and a data report were still created, according to the source material.
“It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
Jenn Gile · OpenSourceMalware co-founder · The Hacker News02 / Distribution scope
Where the reported exposure occurred
Claude Code is distributed through multiple channels. Vendors and researchers cited in the source material said the incident was limited to Cursor’s marketplace.
| Distribution channel | Reported status | What the source says |
|---|---|---|
| Cursor VS Code extension marketplace | Affected | Modified version 2.1.313 was available under the genuine extension ID. |
| Microsoft Visual Studio Marketplace | Not affected | Vendor and researcher accounts say the reported incident did not reach this store. |
| Open VSX | Not affected | Early reports naming Open VSX were corrected, according to the source material. |
| npm package | Not affected | The reported compromise was tied to Cursor’s extension marketplace. |
03 / What remains unknown
The key questions are still unanswered
A maximum estimate describes possible reach, not confirmed infections or successful intrusions. Public details do not settle the impact for each potentially exposed machine.
How was it published?
Cursor has not explained the submission path or how a modified build was accepted under Anthropic’s extension identity.
How many installed it?
The “at most 5,000” estimate is a ceiling. The public information does not confirm downloads, successful changes, or machine-by-machine outcomes.
Was data used?
It remains unclear whether collected data or credentials were used, or whether an attacker successfully logged in. The attacker’s server is now offline.
“It wasn’t a compromise of Anthropic’s systems or employee laptops.”
Felix Rieseberg · Anthropic technical staff04 / Response timeline
Store response and release sequence
Oct 27
Anthropic’s last listed official release before the incident: version 2.1.312.
Oct 29
Cursor marketplace availability reported from 09:27 to 20:35 UTC.
Store rebuilt
Cursor says it removed the version, blocked distribution, audited access, rotated keys, and rebuilt the marketplace before restoring it.
Oct 30
Anthropic published version 2.1.314. Its public list did not include 2.1.313.
The companies have not given times for each response step. Accounts differ on who first detected the incident, and the public record does not resolve the discovery timeline.
05 / If you may be affected
Check the named persistence indicator
If you installed or updated Claude Code in Cursor around October 29, consult Cursor’s current security notice for exact instructions.
Look for the key label
Cursor’s check looks for a key labelled below. If it is present, follow Cursor’s cleanup guidance. Uninstalling the extension alone may not remove persistence or reverse other changes.
Cleanup beyond uninstalling
The source material identifies Cursor’s cleanup scripts and rebuilding the machine as steps to consider if the indicator is found.
Change credentials safely
Consider changing credentials from a separate, trusted computer, and follow the vendor’s current remediation guidance.
Traceability / incident chain
From listing to user action
Marketplace
Modified build listed under a familiar publisher identity.
Update path
Automatic updating could have delivered the version to users.
Check device
Review the svc-telemetry indicator and Cursor’s current notice.
Follow guidance
Use the vendor’s cleanup steps if the key is found.
Cursor said it would contact potentially affected users directly. It also said Anthropic’s systems and official distribution channels were not compromised.
Why Cursor Users Should Check
The incident shows how a compromised extension distribution channel can put a malicious build inside a familiar listing. Because the version carried the genuine extension identifier, users who rely on automatic updates may have received it without deliberately seeking out a new extension. That makes the store and update process part of the security boundary, alongside the software publisher itself.
Cursor’s estimate of at most 5,000 affected users is a ceiling, not a confirmed count of infected machines or successful intrusions. The distinction matters: availability in the store does not show that every eligible user downloaded the version, and an attempted remote-access setup does not by itself prove an attacker logged in. Still, users who had the extension during the exposure window should check for signs of the named key and follow Cursor’s remediation guidance if it appears.
The source material says Cursor’s check looks for a key labelled svc-telemetry. If found, uninstalling the extension alone may not remove persistence or reverse other changes. Cursor’s cleanup scripts, rebuilding the machine and changing credentials from a separate trusted computer are identified as steps to consider. Users should consult Cursor’s current security notice for the exact instructions.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Keys S Wireless Keyboard, Graphite
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How the Update Reached Cursor
The affected build was distributed through Cursor’s VS Code extension marketplace. Early reports naming Open VSX were corrected, according to the source material. The Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected, according to the vendors and researchers cited there. Those distinctions are relevant because Claude Code is distributed through more than one channel, and the reported exposure was tied to Cursor’s store.
Anthropic’s last listed official release before the incident was version 2.1.312, published on GitHub on October 27. On October 30, Anthropic published version 2.1.314. Cursor’s statement described 2.1.313 as a modified extension that was not developed by Anthropic. The gap in Anthropic’s public release sequence supports the distinction between the store build and its official releases; it does not explain who submitted the altered build or how the store accepted it.
Cursor’s marketplace was taken offline during its response and later restored after the company said it had audited access, rotated keys and rebuilt the service. The source material does not give times for each response step. It also records differing accounts of who first detected the incident: Cursor said “we identified” it, while reporting and researchers credited security analysts or a developer alert. The public record described there does not settle the first-discovery timeline.
“impacting at most 5,000 users”
— Cursor
How the Listing Was Compromised
The central unanswered question is how the modified build was published under Anthropic’s extension identity. Cursor has not explained the submission path or identified who had the access needed to place it in the marketplace. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the source material does not provide further detail about that access or the person or group responsible.
It also remains unclear how many users actually installed version 2.1.313, how many machines had the attempted changes succeed, whether any credentials or other sensitive data were used after collection, and whether any attacker logged in. Cursor’s maximum estimate and the reported failure of SSH activation on most systems do not answer those questions for each potentially affected user.
Checks and Vendor Follow-Up
Cursor said it would contact potentially affected users directly. Users who installed or updated Claude Code in Cursor around October 29 should check Cursor’s security notice and use its svc-telemetry key check. If the key is present, they should follow Cursor’s cleanup instructions; the source material says to consider rebuilding the machine and changing credentials from a different, trusted computer.
The next material update would be an explanation of how the listing was altered, alongside clearer figures for downloads and confirmed impact. Cursor has said it audited access and rotated marketplace keys, while Anthropic has said its systems and official channels were unaffected. The public information in the source material does not include a detailed incident report or a confirmed account of successful attacker access.
Key Questions
Which Claude Code version was affected?
The reported tampered build was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public release list did not include that version as an official release as of October 30, 2026.
Was the extension available in other marketplaces?
According to the vendors and researchers cited in the source material, the reported incident affected Cursor’s marketplace. The Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports naming Open VSX were corrected.
Does the incident mean attackers accessed every affected computer?
No. The code reportedly attempted to establish remote access, but Cursor said the administrator-level SSH step failed on most Macs and Windows PCs. The available information does not confirm how many machines were accessed or whether any attacker logged in.
What should Cursor users check?
Users who had Claude Code installed or updated in Cursor during the exposure period should use Cursor’s check for a key labelled svc-telemetry and follow the company’s current remediation guidance if it is present. The source material says uninstalling alone may not be sufficient.
Source: Thorsten Meyer AI
