🔍 Read the full analysis: What Happened In The Tampered Claude Code Update—and What To Check on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified version of Anthropic’s Claude Code extension was distributed through Cursor’s marketplace for about 11 hours on Oct. 29, according to Cursor. Cursor says up to 5,000 users may have been affected and recommends checking for an unauthorized SSH key; the method used to publish the build under Anthropic’s extension identity remains unexplained.
Cursor says a tampered Claude Code extension was available in its VS Code marketplace for about 11 hours on Oct. 29, posing a risk to users who installed or updated it. The modified build, version 2.1.313, used Anthropic’s extension name and identifier but was not built by Anthropic, according to Cursor and security researchers; Cursor estimates that at most 5,000 users may have received it.
Cursor places the availability window at 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29 (09:27–20:35 UTC). The company says it removed the version after detection, blocked further distribution and temporarily shut down its VS Code extension marketplace while it reviewed the incident. Cursor said it audited marketplace access, rotated keys and rebuilt the marketplace before restoring it. It has not published the timing of each response step.
Analyses by security firms Phorion and OpenSourceMalware, as summarized in the source report, describe a small malicious loader placed ahead of the extension’s normal code. The loader reportedly ran when the editor loaded the extension, without requiring a user to open Claude Code or click anything. Researchers say it gathered information about the computer and attempted to add an attacker-controlled SSH public key, enable remote login, create a tunnel to an attacker’s server and persist across restarts.
Cursor says the attempt to enable SSH access required administrator privileges and failed on most Macs and Windows computers. That limits what the attacker could do through the tunnel on those machines, but it does not mean the extension made no changes: the source report says the key, startup entries and a data report could still have been written. Cursor also says the attacker’s server is now offline. These details do not establish that every listed action succeeded on every affected device.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why an Extension Update Was Risky
The incident matters because the modified build reportedly appeared as an update to the real extension listing, using the legitimate identifier anthropic.claude-code, rather than as an obvious copy with a misspelled name. Users with automatic extension updates could have received it without taking a separate action. That makes the distribution route a software supply-chain concern: a familiar listing and update channel may not, by themselves, prove that a particular build came from its named developer.
Code editor extensions can operate in a developer’s working environment, where files, source code and development tools are available. An attempt to establish persistent remote access is especially relevant for developers because their machines may contain credentials or access to company systems. The reports describe attempted actions, not confirmed theft of particular credentials, source code or data. The reported failure of the administrator-dependent SSH step on most Macs and Windows PCs is a qualification, not a reason for affected users to skip checks.
Cursor’s figure is an estimate of the possible reach: up to 5,000 users. The published material does not establish how many people installed the build, how many devices were successfully altered or whether any data was used after collection. Those distinctions matter when users and organizations decide whether to investigate a device, rotate credentials or notify security teams.
Products Worth Considering
Ring Alarm 5-Piece Wireless Security System
Philips Hue Secure Wired Video Doorbell, 2K Resolution, Wide Angle View, Integrated Hue Lights, Two-Way Audio, Infrared Night Visibility, Bl
Ring Alarm 8-Piece Kit (2nd Gen) Home Security System
As an affiliate, we earn on qualifying purchases.
How Version 2.1.313 Reached Cursor
Anthropic’s public GitHub release history went from Claude Code 2.1.312, published on Oct. 27, to 2.1.314, released on Oct. 30, according to the source report. It lists no official 2.1.313 release. The affected build was distributed through Cursor’s VS Code extension marketplace, not through every channel that offers Claude Code.
Cursor says the incident involved its marketplace and that it removed the build and took steps to rebuild the service. Anthropic technical staff member Felix Rieseberg said the event was not a compromise of Anthropic’s systems or employee laptops. Anthropic’s position, as reported by the source, was that a malicious actor used access to Cursor’s marketplace. The source also says the Claude Code releases on Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected; early reports naming Open VSX were corrected.
Public accounts differ on who first identified the incident: Cursor says it identified it, The Register credited Phorion with spotting it, and OpenSourceMalware thanked a developer who alerted the group. The available material does not settle that timeline. It also does not explain how the modified build was published under the extension’s Anthropic-associated identity.
““impacting at most 5,000 users””
— Cursor
The Publishing Route Is Unexplained
Cursor and Anthropic have not publicly explained how the modified build entered Cursor’s marketplace under Anthropic’s extension identity. The source report attributes to Anthropic the statement that a malicious actor used access to Cursor’s marketplace, but does not provide a technical account of what access was obtained or how it was used. Cursor has not described the entry point.
The confirmed number of people who installed the version, the number of devices on which the loader completed each action, and whether the collected information was accessed or misused remain unclear. The source report says the attacker’s server is offline and the SSH-enabling step failed on most Macs and Windows PCs, but it does not establish the outcome for every affected machine. Cursor’s possible reach of up to 5,000 users should not be treated as a count of confirmed victims.
The source report says other distribution channels were not affected and notes that early claims about Open VSX were corrected. Readers should rely on the named vendor and researcher statements rather than treating initial reports about a different marketplace as confirmed.
Check Cursor and Secure Credentials
Cursor advises users who used Claude Code in Cursor to check for an SSH key labeled svc-telemetry. The source report says to use Cursor’s check for that key and, if it is present, not to rely on simply uninstalling the extension. Cursor’s cleanup scripts are recommended; users and organizations may also consider rebuilding the affected machine, depending on their security needs.
If the key is found, change credentials from a different, trusted computer, rather than from the machine being investigated. Developers should involve their organization’s security team where applicable and consider which credentials or systems the device could access. These are precautions; the presence of the key is a sign to investigate, not by itself evidence that every account or file was accessed.
Cursor says it will contact affected users directly. The next useful update would explain how the build was published, how many users actually installed it, and what evidence exists about successful access or data use. Until those details are available, users should verify the extension channel and version on their Cursor machines and follow Cursor’s published checks and cleanup guidance.
Key Questions
What happened to the Claude Code extension in Cursor?
Cursor says a modified version 2.1.313 was available in its VS Code marketplace for about 11 hours on Oct. 29. The build used Anthropic’s extension name and identifier but was not built by Anthropic, according to Cursor and researchers.
What should Cursor users check?
Check for an SSH key labeled svc-telemetry, using Cursor’s recommended check. If it is present, the source report says uninstalling the extension is not enough: use Cursor’s cleanup scripts and change credentials from a separate, trusted computer.
Does the report confirm that attackers stole files or passwords?
No. Researchers describe code that gathered computer information and attempted to establish remote access, but the available reporting does not confirm that specific files or credentials were stolen or misused. Cursor says the administrator-dependent SSH step failed on most Macs and Windows PCs.
Were other Claude Code distribution channels affected?
The source report says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected. It also notes that early reports identifying Open VSX as the source were corrected.
How did the tampered build get published?
That remains unclear. The source report says Anthropic attributed the incident to a malicious actor using access to Cursor’s marketplace, but Cursor has not explained how the actor published the build under the extension’s identity.
Source: ThorstenMeyerAI.com
