🔍 Read the full analysis: 5 Checks For Cursor Users After The Claude Code Update Tampering on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a tampered Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29 and may have reached up to 5,000 users. The build attempted to collect system information and establish persistent remote access; Cursor advises affected users to check for an SSH key labelled svc-telemetry and follow its cleanup guidance.
Cursor says a tampered version of Anthropic’s Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The extension used the legitimate name and identifier, but Cursor and security researchers say the build was not made by Anthropic and attempted to collect system details and establish persistent remote access.
According to Cursor, version 2.1.313 was available from 09:27 to 20:35 UTC on October 29. Cursor says it removed the version after detecting the issue, blocked further distribution, temporarily shut down its VS Code extension marketplace, reviewed access, rotated marketplace keys and rebuilt the marketplace before restoring it. It has not published exact timings for those follow-up steps.
Security analyses by Phorion and OpenSourceMalware describe a loader placed before the extension’s legitimate code. The researchers say it ran when the editor loaded the extension, without requiring a user to open Claude Code or approve a prompt. It attempted to gather information about the computer, add an attacker-controlled SSH public key, enable remote login, create a tunnel to an attacker’s server and persist through restarts.
Cursor says the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That limited one route to remote access, but does not establish that every other action failed. Cursor says the server used by the attacker is offline. Users who had the affected extension installed should check for a key labelled svc-telemetry; Cursor says removing the extension alone is not sufficient if that key or other changes remain.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
A Trusted Extension Channel Was Abused
The incident matters because the malicious build appeared as an update to the real Claude Code listing, under its expected identifier, rather than as an obvious imitation with a misspelled name. Users with automatic updates enabled could have received it without choosing a new extension or taking another action. The case shows that a familiar publisher name and marketplace listing do not, on their own, verify the code delivered in an update.
Developer extensions can run with access to local files, source code and development tools. An attempt to add an SSH key or collect system information could put more than one project at risk, depending on the machine’s permissions and the attacker’s access. The available reporting does not establish that the attacker successfully logged in to affected computers or obtained particular credentials or source code. Those limits matter: the reported malicious behavior is serious, but the extent of any successful access remains unconfirmed.
For Cursor users, the practical issue is whether the affected release reached their installation and whether the attempted changes persisted. A marketplace takedown stops new downloads through that channel, but does not by itself undo changes on computers that already installed the build.
Products Worth Considering
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
Apple MacBook Air 13-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, 12MP Center Stage Camera, and Wi-Fi 7, Sky Blue
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Version and Distribution Window
Cursor identifies the affected package as Anthropic.claude-code version 2.1.313, distributed through Cursor’s VS Code extension marketplace on October 29. Anthropic’s public GitHub release history went from version 2.1.312, published October 27, to version 2.1.314, published October 30; the source material says there is no official 2.1.313 release listed there.
Early reports incorrectly identified Open VSX as the distribution source and were corrected. According to the source material, the reported affected channel was Cursor’s marketplace. Claude Code obtained through Microsoft’s Visual Studio Marketplace, Open VSX or the npm package was not identified as affected in the vendor and researcher statements described in that reporting.
Anthropic said its systems were not compromised and its official distribution channels were unaffected. Felix Rieseberg, a member of Anthropic’s technical staff, said on October 30 that the incident was not a compromise of Anthropic systems or employee laptops. Cursor said a malicious actor used access to its marketplace. Neither company had publicly explained how the modified package was published under the Anthropic extension identity.
“The affected extension impacted at most 5,000 users.”
— Cursor
Exposure and Publication Route Remain Unknown
The number of users who installed the build is not confirmed; Cursor’s figure is an upper bound of 5,000 potentially affected users. The public information described in the source material does not show how many systems received the extension, whether any attacker successfully used the tunnel, or whether data collected by the code was accessed or acted on.
It also remains unclear how the modified package was published under Anthropic’s extension identity, who first detected it and whether any specific users experienced unauthorized access. Cursor says the attack server is offline, but that fact alone does not confirm what data, if any, reached it while it was active. The vendors’ statements and researchers’ analyses identify attempted actions; they do not settle the full impact on individual machines.
Check the Key and Follow Cursor’s Guidance
Cursor’s immediate instruction is for users of Claude Code in Cursor to check for an SSH key labelled svc-telemetry. If it is present, Cursor advises using its cleanup scripts; simply uninstalling the extension may leave changes behind. The company’s guidance also says users should consider rebuilding the machine and changing credentials from a different, trusted computer. Users should consult Cursor’s official security notice for the current instructions rather than relying on an old copy of the affected extension.
Cursor says it will contact users it identifies as affected. Users should watch for that notice and for any further details from Cursor or Anthropic about the publication route and investigation. Until more information is released, the incident’s confirmed scope is limited to the affected Cursor marketplace version and the companies’ stated maximum estimate; individual exposure should be assessed on the device itself.
Key Questions
Which Claude Code version was involved?
Version 2.1.313 was the tampered build identified in Cursor’s marketplace. The source material says Anthropic’s public release history went from 2.1.312 to 2.1.314, with no official 2.1.313 release listed.
How can Cursor users check for the reported change?
Check for an SSH public key labelled svc-telemetry, as Cursor advises. If it is present, follow Cursor’s official cleanup instructions; uninstalling the extension alone may not remove changes made by the package.
Does the report confirm that attackers accessed users’ computers?
No. The code attempted to create a route for remote access, but the source material does not confirm successful logins or the number of systems accessed. Cursor says enabling SSH required administrator rights and failed on most Macs and Windows PCs.
Were Claude Code users outside Cursor affected?
The source material says Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not identified as affected. The reported distribution was through Cursor’s VS Code extension marketplace; early reports naming Open VSX were corrected.
What remains unknown about the incident?
It is not clear how the modified build was published under Anthropic’s extension identity, how many users actually installed it, or whether information reached the attacker. Cursor’s estimate of up to 5,000 refers to potential impact, not confirmed successful compromise.
Source: ThorstenMeyerAI.com
