🔍 Read the full analysis: What To Review Now After A Tampered Claude Code Update on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a tampered Claude Code extension, version 2.1.313, was available in its marketplace for about 11 hours on October 29 and could have reached as many as 5,000 users. The build attempted to collect system details and establish persistent remote access; Cursor and Anthropic say their own systems were not compromised. Cursor users should check for an SSH key labelled svc-telemetry and follow the vendor’s cleanup guidance if it is present.
Cursor said the modified version was available from **09:27 to 20:35 UTC on October 29**. It removed the build after detecting the incident, blocked further distribution and shut down its VS Code marketplace while it reviewed access, rotated keys and rebuilt the marketplace. Cursor later restored the store. The company said it would **contact potentially affected users directly**.
Analyses by security researchers describe a small malicious loader placed before the extension’s normal code. It ran when the extension loaded in Cursor, without requiring a user to click a link or open Claude Code. Researchers said the code tried to collect information about the computer, add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts.
Cursor said the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That may have prevented remote login through the tunnel on those machines, but does not establish that every other action failed. Cursor and researchers said the **SSH key, startup entries and a data report** could still have been written. The attacker’s server was reported offline by the source article.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Carry Risk
The incident shows how a compromised distribution channel can make a harmful update appear under a **familiar extension name and identifier**. Users who had automatic updates enabled may have received the modified build without seeking out a separate, look-alike extension. That makes checking the installation history and system for indicators more useful than relying on the listing’s name alone.
For developers, the potential exposure matters because code editors can access **local files, source code and development tools** available to the logged-in user. Even where the attempted remote-login step failed, an extension that ran locally could have had access to sensitive material. The public information does not confirm that every affected computer was accessed or that credentials were stolen; users should treat the possibility of exposure seriously while avoiding assumptions that compromise occurred on every device.
The incident also puts pressure on marketplace operators to explain how a package was published under a trusted publisher’s identity and what controls failed. Cursor says it audited access and rotated marketplace keys, but has not publicly described the entry route. Until that is explained, users and organizations cannot fully judge whether the safeguards that allowed this version to appear have changed.
Products Worth Considering
Apple iPad Air (2025) 13‑inch Wi‑Fi 256 GB – Space Gray (M3 chip)
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Bose QuietComfort Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones, Black
As an affiliate, we earn on qualifying purchases.
What Happened in the Marketplace
The affected listing was identified as **anthropic.claude-code**, according to security researchers cited in the source report. The issue was not described as a typo-based imitation: the modified version appeared as an update to the extension listing users associated with Anthropic. The last official Claude Code release before the incident was version **2.1.312**, published on GitHub on October 27. Anthropic’s next public release was 2.1.314 on October 30; its release list contained no 2.1.313 entry when checked that day.
Cursor’s notice says the incident was limited to its **VS Code extension marketplace**. The source report says Claude Code distributions from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected, and notes that early reports naming Open VSX were corrected. Those distinctions matter: users should identify where their extension came from rather than infer exposure from the product name alone.
Attribution for the initial discovery differs among public accounts. Cursor said it identified the incident; The Register credited Phorion with first spotting it, while OpenSourceMalware thanked a developer who alerted it. The source report does not establish a definitive public timeline for who first detected the malicious build.
““impacting at most 5,000 users””
— Cursor
What Investigators Have Not Established
The central unresolved issue is **how the modified extension entered Cursor’s marketplace under Anthropic’s identity**. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not publicly explained how the listing was published or whose account or credentials were involved. The available reports do not establish the attacker’s identity or motive.
Cursor’s estimate of **up to 5,000 users** describes possible reach, not a verified count of installations, machines accessed or people whose data was taken. The public material also does not specify what information the malware’s report contained, how many systems received it, or whether any credentials or source code were exfiltrated. The SSH privilege requirement may have limited one part of the attempted access, but does not answer those questions.
It is also unclear how Cursor determined the potentially affected user list and whether all users who installed the version will receive direct notification. The source report says Cursor planned to contact users, but gives no completion status as of October 30.
Checks for Cursor Claude Code Users
Cursor users who installed or updated Claude Code during the incident window should follow Cursor’s security notice and **check for an SSH key labelled `svc-telemetry`**. The source material says that if the key is present, removing the extension alone is not enough: users should run Cursor’s cleanup scripts. Because this concerns access to a development machine, organizations should have their security teams assess the device and preserve relevant evidence before making changes where incident-response procedures require it.
The source report also advises affected users to consider rebuilding the machine and changing credentials **from a different, trusted computer**. That is precautionary guidance, not confirmation that every exposed machine was compromised. Users should avoid entering new secrets on a system they suspect may still be affected until they have followed trusted remediation advice.
Cursor’s stated next step is to contact potentially affected users. Users and security teams will also be looking for a fuller account of how the malicious build was published, what data it collected and whether the marketplace controls have changed. Until those details are public, the safest assessment is that the distribution window and reported behavior are known, while the scope of actual compromise remains unconfirmed.
Key Questions
Was the affected Claude Code version made by Anthropic?
No. Cursor and security researchers said version 2.1.313 was modified and was not developed by Anthropic, despite using the extension’s name and identifier.
Who may have received the tampered update?
Cursor said the modified build was available in its VS Code extension marketplace for about 11 hours on October 29 and may have affected up to 5,000 users. That is an upper estimate, not a confirmed number of installations or compromised computers.
What should affected Cursor users check?
Check for an SSH key labelled svc-telemetry and follow Cursor’s security notice. The source report says users who find the key should use Cursor’s cleanup scripts; uninstalling the extension alone may not remove other changes.
Were other Claude Code distributions affected?
The source report says the versions from Microsoft’s Visual Studio Marketplace, Open VSX and npm were not affected. It also says early reports that named Open VSX were corrected.
Does the incident prove that user data was stolen?
No. Researchers described an attempted data report and persistence mechanisms, but the public information does not establish what data was collected, whether it reached the attacker, or how many machines were accessed. Cursor’s potential-user estimate is not a confirmed breach count.
Source: ThorstenMeyerAI.com
