🔍 Read the full analysis: Review Your Cursor Setup After The Claude Code Update Reached Users on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s VS Code extension marketplace for about 11 hours on Oct. 29, according to Cursor. The companies say Anthropic’s systems and other distribution channels were not affected; Cursor says at most 5,000 users may have received the build and will contact them. The method used to publish it under Anthropic’s extension identity remains unexplained.
A tampered version of Anthropic’s Claude Code extension was available in Cursor’s VS Code extension marketplace for about 11 hours on Oct. 29, Cursor says, potentially reaching up to 5,000 users. The build used the official extension’s name and identifier, but Cursor says it was not made by Anthropic; the companies have not explained how it was published under that identity.
Cursor says the affected release was version 2.1.313, available from about 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29. The company removed it after detection, blocked further distribution and temporarily shut down its VS Code marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor says it will contact affected users directly.
Security analyses by Phorion and OpenSourceMalware describe a loader placed before the extension’s legitimate code. It ran when the editor loaded the extension, without a separate click or command. Researchers say the added code collected information about the computer and attempted to add an attacker-controlled SSH key, enable remote login, create a tunnel to an attacker’s server and persist through restarts.
Cursor says the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. It also says the attacker’s server is now offline. Those points do not establish that every other action failed: the researchers’ reports say the key, startup entries and a data report were still created or sent. Cursor’s estimate is a maximum of 5,000 potentially affected users, not a confirmed count of machines accessed or people whose data was taken.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Matter
The incident shows how a compromised software distribution channel can put malicious code inside an extension that users recognize and trust. Because the altered build appeared under the real extension name and identifier, users relying on routine updates could have received it without deliberately installing a look-alike. The loader’s reported execution on editor startup also means that simply avoiding Claude Code commands would not necessarily have prevented it from running.
For developers, an editor extension can have access to local files, source code and tools available to the user. An attempt to add an SSH key or enable remote access raises the possibility of continued access beyond the initial editor session, although the extent of successful access in this incident has not been established publicly. Cursor’s estimate indicates potential exposure, not proof of compromise for every user in that group.
The recommended response is more than removing the extension if the suspicious key is present. Cursor’s guidance, as described in the source material, is to run its check for a key labelled svc-telemetry and, if found, use the company’s cleanup scripts. Users should change credentials from a separate trusted computer and consider rebuilding the affected machine.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Affected Cursor Release
Anthropic’s official GitHub release list showed version 2.1.312 as the last release before the incident and then moved to 2.1.314 on Oct. 30, according to the source material. The public list has no 2.1.313 entry. The incident build was distributed through Cursor’s marketplace, rather than through the official release sequence described by Anthropic.
Cursor says its marketplace was the source of the affected extension. Anthropic said its own systems were not compromised, and its technical staff said employee laptops were not involved. The source material also reports that Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports that named Open VSX were corrected.
Cursor said it removed the build after identifying the incident and later restored its marketplace after security steps that included auditing access, rotating keys and rebuilding the service. The public account does not provide exact times for each response step. Security researchers and news organizations published analyses and reports on Oct. 30.
““impacting at most 5,000 users””
— Cursor
How the Listing Was Compromised
The central unanswered question is how the altered build appeared under Anthropic’s extension identity in Cursor’s marketplace. Cursor has not publicly explained the publishing path. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available account does not specify whose access was used, how it was obtained or whether the underlying weakness has been identified.
The total number of downloads or installations, and how many devices experienced each attempted action, are also not established in the source material. Cursor’s figure of at most 5,000 is an estimate of users potentially affected. It is not a verified tally of successful SSH access, stolen credentials or data exfiltration. The attacker’s server being offline limits one reported route of contact but does not by itself show what information may already have been sent.
The public record also does not settle who first detected the incident. Cursor says it identified it; The Register credited Phorion with first spotting it, while OpenSourceMalware thanked a developer who alerted the group. The source material does not resolve those accounts.
Checks for Cursor Claude Code Users
Cursor says it will contact affected users directly. Users who had Claude Code installed in Cursor during the exposure window should check the company’s incident guidance and run its check for an SSH key labelled svc-telemetry. A clean result does not answer every question about what the extension did, but a match calls for the cleanup steps Cursor provides.
If the key is present, the source material says uninstalling the extension alone is insufficient. Users should use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate trusted device. They should also follow updates from Cursor and Anthropic for any revised scope, remediation guidance or explanation of how the malicious package entered the marketplace.
Further public information is needed on the marketplace access route, the number of installations and the results of Cursor’s audit. Until those details are released, the confirmed account is limited: a maliciously modified build was available for about 11 hours, Cursor says it has removed it and will notify users, and the publication method remains unresolved.
Key Questions
Which Claude Code extension version was affected?
The affected build was version 2.1.313 in Cursor’s VS Code extension marketplace, according to Cursor and the cited security analyses.
When was the modified extension available?
Cursor says it was available on Oct. 29 from about 2:27 a.m. to 1:35 p.m. Pacific time, a period of roughly 11 hours.
Does the incident mean every exposed computer was accessed?
No. Cursor estimates that at most 5,000 users may have been affected, but the available information does not confirm how many installed the build or experienced successful remote access. Cursor says the SSH-enabling step failed on most Macs and Windows PCs because it required administrator privileges.
What should a Cursor user check?
Run Cursor’s check for an SSH key labelled svc-telemetry. If it appears, follow Cursor’s cleanup instructions; the source material says uninstalling the extension alone is not enough. Change credentials from a separate trusted computer and consider rebuilding the machine.
Were other Claude Code distribution channels affected?
The source material says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports naming Open VSX were corrected. Anthropic also said its own systems were not compromised.
Source: ThorstenMeyerAI.com
