🔍 Read the full analysis: A Look At The Claude Code Update That Reached Cursor Users on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29, 2026. The package used Anthropic’s extension name and identifier; Cursor estimates up to 5,000 users may have been affected. The companies say Anthropic’s systems and other distribution channels were not compromised, but the route used to publish the tampered build remains unexplained.
Cursor says a maliciously modified Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially affecting up to 5,000 users. The build, version 2.1.313, appeared under Anthropic’s legitimate extension name and identifier, but Cursor says it was not made by Anthropic. The incident matters because the extension could run when Cursor loaded it, without a user opening Claude Code or clicking a prompt.
According to Cursor’s security notice, version 2.1.313 was available from approximately 2:27 a.m. to 1:35 p.m. Pacific time on October 29. Cursor says it removed the version after detecting the issue, blocked further distribution and temporarily shut down its VS Code extension marketplace. It later audited access, rotated marketplace keys, rebuilt the marketplace and restored it. Cursor has not provided timings for each response step.
Security researchers described a malicious loader placed ahead of the extension’s legitimate code. OpenSourceMalware said the added section was 66 lines long. The analysis cited in the source material says it collected information about the computer, added an attacker-controlled SSH public key, attempted to enable remote login and open a tunnel to an attacker’s server, and added persistence mechanisms intended to survive restarts. The code reportedly ran when the extension loaded.
Cursor says the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That limits what the attacker could do through the remote-login route on those machines, but it does not establish that every other part of the payload failed. Cursor says the attacker’s server is now offline. It estimates that no more than 5,000 users were affected and says it will contact them directly.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Marketplace Route Matters
The incident shows how an update distributed through a familiar software marketplace can carry risk even when it uses a trusted extension’s name and identifier. According to the reporting and researcher analyses cited by ThorstenMeyerAI.com, this was not simply a separate extension with a similar name: the tampered release appeared as an update to the established listing. Users with automatic extension updates may have received it without taking a separate action.
For developers, an editor extension can have access to local files, source code and development tools. That makes a compromised package a potential route to sensitive information or further access on a workstation. The attempted SSH changes raised that concern, though Cursor says the required privilege was unavailable on most Macs and Windows PCs. The 5,000 figure is Cursor’s maximum estimate, not a confirmed count of machines where the payload succeeded.
The episode also puts attention on the marketplace’s publishing and identity checks. Cursor’s removal and marketplace rebuild reduced the period in which the package was available, but the public account does not yet explain how a modified build was published under Anthropic’s extension identity.
Popular right now
De'Longhi Rivelia Automatic Espresso Machine with Milk Frother
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
As an affiliate, we earn on qualifying purchases.
How Version 2.1.313 Appeared
Anthropic’s public release history, as checked by the source on October 30, went from Claude Code 2.1.312 to 2.1.314; it did not list an official 2.1.313 release. The last official version before the incident was published on GitHub on October 27, and version 2.1.314 appeared on October 30. The disputed 2.1.313 package was instead available through Cursor’s VS Code extension marketplace.
Cursor’s account places the distribution window on October 29, from 09:27 to 20:35 UTC. The company says it removed the build upon detection and took the marketplace offline as a precaution while it reviewed access and rebuilt the service. Some early reports incorrectly identified Open VSX as the source and were corrected, according to the source material. It says the Claude Code listings from Microsoft’s Visual Studio Marketplace and Open VSX, as well as the npm package, were not affected.
Public accounts differ on who first spotted the incident: Cursor says its team identified it, The Register credited Phorion, and OpenSourceMalware acknowledged a developer who alerted it. The available reporting does not settle that sequence. On October 30, Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic systems or employee laptops.
“The modified extension was “impacting at most 5,000 users.””
— Cursor
How the Tampered Build Was Published
The companies have not publicly explained how the attacker published the modified package under Anthropic’s extension identity in Cursor’s marketplace. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available source material does not specify what access was obtained, how it was used or whether a particular account or publishing control was compromised.
The maximum estimate of 5,000 potentially affected users does not show how many devices actually ran the extension, what information the malware successfully collected or whether any machine was accessed through the attempted SSH tunnel. Cursor says SSH activation failed on most Macs and Windows PCs and that the server is offline; those statements do not establish the outcome for every affected system. Public reporting also has not resolved who detected the package first.
Checks for Cursor Claude Code Users
Cursor says it will contact users it identifies as potentially affected. Users who installed or updated Claude Code through Cursor during the October 29 exposure window should follow Cursor’s incident guidance and check for an SSH key labeled svc-telemetry. The source material says that if the key is present, simply uninstalling the extension is not enough: users should use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer.
The next public milestones are further detail from Cursor on the marketplace publishing path and its user notifications, along with any updated findings on affected systems. Until those details are available, the confirmed facts are limited to the package’s distribution window, Cursor’s maximum exposure estimate and the response steps the company has described. The impact on individual users remains a matter for device-specific investigation.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 appeared in Cursor’s marketplace under Anthropic’s extension name and identifier on October 29. Cursor says the build was not created by Anthropic and was available for about 11 hours.
How many Cursor users may have been affected?
Cursor estimates that at most 5,000 users may have been affected. That is a maximum exposure estimate; the public information does not establish how many devices ran the malicious code or suffered successful access.
What should users check?
Users who had Claude Code in Cursor during the exposure window should follow Cursor’s instructions and check for an SSH key labeled svc-telemetry. If it appears, the source material says to use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a trusted device.
Was Anthropic itself breached?
Anthropic staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. The available account attributes the malicious build to access involving Cursor’s marketplace, but does not explain how that access was obtained.
Were other Claude Code distribution channels affected?
According to the source material, Claude Code from Microsoft’s Visual Studio Marketplace and Open VSX, along with the npm package, were not affected. Early reports that named Open VSX as the source were corrected.
Source: ThorstenMeyerAI.com
