🔍 Read the full analysis: When The Name Is Right But The Code Isn’t: Checking Your AI Tools on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. The build used Anthropic’s real extension identity but was not made by Anthropic; Cursor estimates at most 5,000 users were affected and says it will contact them. Cursor users should check for an SSH key labelled svc-telemetry and follow Cursor’s cleanup guidance if it appears.
Cursor’s marketplace distributed a maliciously modified Claude Code extension for about 11 hours on October 29, the company says, exposing users who installed or updated version 2.1.313 to code designed to establish remote access. The extension carried Anthropic’s legitimate name and identifier but was not built by Anthropic. Cursor estimates that at most 5,000 users were affected and says it will contact them directly.
Cursor says version 2.1.313 was available from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC). It removed the build after detecting the incident, blocked further distribution and temporarily shut down its VS Code extension marketplace. Cursor says it audited access, rotated marketplace keys, rebuilt the marketplace and restored service. It has not publicly explained how the modified extension was published under Anthropic’s identity.
Analyses by security firms Phorion and OpenSourceMalware describe a small loader placed ahead of the extension’s legitimate code. They say it ran when the editor loaded the extension, without a separate click, and attempted to collect computer details, add an attacker-controlled SSH key, enable remote login, open a tunnel to an outside server and persist across restarts. Cursor says the step to enable SSH required administrator privileges and failed on most Mac and Windows machines. That limitation did not prevent the extension from adding the key or sending a report of collected data, according to the source material.
Cursor says the attacker’s server is now offline. Anthropic says its own systems were not compromised and its official distribution channels were unaffected. The affected listing was in Cursor’s marketplace; early reports that named Open VSX were corrected. The source material also says Claude Code distributed through Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Identity Was Not Enough
The incident shows why a familiar publisher name and extension identifier cannot, on their own, establish that an update is authentic. This was not described as a separate look-alike listing: the modified build appeared as an update to the real Claude Code listing in Cursor’s marketplace. Users with automatic extension updates may have received it without choosing to install a new tool.
For developers, an extension can operate inside an environment that contains source code, local files and access to development tools. The researchers’ analysis describes an attempted route to persistent remote access, although Cursor says a required administrator-level step failed on most affected computers. The precise exposure for any individual user depends on whether the extension was installed or updated and what happened on that machine.
The event also puts attention on the security responsibilities of software marketplaces. Cursor says it took the listing down and rebuilt its marketplace, but the public information does not yet identify how the attacker obtained the ability to publish under Anthropic’s extension identity. That question matters to users evaluating whether the problem was limited to one build or points to a weakness in the marketplace’s publishing controls.
Products Worth Considering
Bose QuietComfort Ultra Wireless Noise-Cancelling Headphones with Spatial Audio, Black
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
How the Rogue Update Reached Cursor
Anthropic’s last official release before the incident was version 2.1.312, published on GitHub on October 27, according to the source material. Cursor’s marketplace then offered the modified 2.1.313 on October 29. Anthropic’s public release list moved from 2.1.312 to 2.1.314, which Anthropic released on October 30; it contains no official 2.1.313 entry.
Cursor’s marketplace is a distribution channel for extensions used with its code editor. The affected item retained the identifier anthropic.claude-code, according to reporting and researchers cited in the source material. Cursor says it detected and removed the build, then suspended its broader VS Code marketplace while it reviewed access and rebuilt the service. Reports that initially attributed the incident to Open VSX were corrected: the source identified in Cursor’s notice was Cursor’s marketplace.
The public accounts differ on who first spotted the suspicious build. Cursor says it identified the incident; The Register credited Phorion with first spotting it, while OpenSourceMalware thanked a developer who alerted the group. The available material does not settle that sequence.
“The modified extension was “impacting at most 5,000 users.””
— Cursor
How the Listing Was Compromised
How the modified build entered Cursor’s marketplace under Anthropic’s name remains unknown. Cursor has not publicly described the publishing path or identified the person or group responsible. Anthropic says a malicious actor “used access to Cursor’s marketplace,” but the available material does not explain what access was used or how it was obtained.
Cursor’s figure of at most 5,000 users is an estimate of potential impact; the number of machines on which the attempted actions succeeded has not been stated. Cursor says enabling SSH failed on most Macs and Windows PCs because it required administrator rights, but the source material gives no full breakdown by operating system or affected action. The account also does not establish whether any user’s machine was accessed through the tunnel.
The attackers’ server is reported to be offline, but that does not establish that every affected device has been cleaned or that all associated credentials are safe. The public record also does not settle who first detected the extension.
Checks Cursor Users Should Run
Cursor says it will contact users it believes were affected. Anyone who installed or updated Claude Code through Cursor during the exposure window should run Cursor’s check for an SSH key labelled svc-telemetry. The source material warns that simply uninstalling the extension is not enough if the key or persistence entries were added.
If the key is present, users should follow Cursor’s cleanup scripts and consider rebuilding the machine, according to the supplied guidance. They should change credentials from a separate, trusted computer rather than from a device that may have been affected. Users should consult Cursor’s current security notice for the exact detection and cleanup steps.
The next public milestones are a fuller account of how the marketplace listing was published and clearer figures on actual impact. Cursor has not announced when it will provide further details. Until then, the vendor statements establish the affected distribution channel and exposure window, but not the number of machines where the attempted remote-access steps succeeded.
Key Questions
Which Claude Code version was affected?
Version 2.1.313 in Cursor’s VS Code extension marketplace was modified, according to Cursor and the researchers cited in the source material. Anthropic’s official release list went from 2.1.312 to 2.1.314.
Was Anthropic’s system compromised?
Anthropic says its systems and employee laptops were not compromised. The affected build was distributed through Cursor’s marketplace, not through Anthropic’s official channels, according to the companies’ statements summarized in the source material.
How can Cursor users check whether they were affected?
Run Cursor’s check for an SSH key labelled svc-telemetry, particularly if Claude Code was installed or updated through Cursor during the October 29 exposure window. Follow Cursor’s security notice for cleanup instructions if the key is found.
Does uninstalling the extension remove the risk?
Not necessarily. The supplied guidance says uninstalling alone may not remove the added SSH key or startup entries. Cursor users who find the indicator should use the company’s cleanup scripts, consider rebuilding the machine and change credentials from a separate trusted computer.
Were other Claude Code distribution channels affected?
The source material says the versions distributed through Microsoft’s Visual Studio Marketplace, Open VSX and npm were not affected. Early reports naming Open VSX were corrected.
Source: ThorstenMeyerAI.com
