🔍 Read the full analysis: Why Cursor Users Should Check The Claude Code Update They Installed on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A modified Claude Code extension, version 2.1.313, was available through Cursor’s marketplace for about 11 hours on Oct. 29, according to Cursor. It was not built by Anthropic and may have reached up to 5,000 users; affected Cursor users should check for a key labelled svc-telemetry and follow Cursor’s cleanup guidance if it appears.
A tampered Claude Code extension was available in Cursor’s VS Code marketplace for about 11 hours on Oct. 29, Cursor says, potentially exposing up to 5,000 users to code that tried to establish persistent remote access to their computers. The extension appeared under Anthropic’s name and identifier, but was not built by Anthropic; Cursor says it removed the version and will contact affected users.
The affected release was listed as Anthropic.claude-code version 2.1.313. Cursor says it was available from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29, or 09:27 to 20:35 UTC. The company has described the potential reach as at most 5,000 users; that is an upper estimate, not a confirmed count of computers successfully compromised.
Security analyses by Phorion and OpenSourceMalware describe a small block of malicious code placed ahead of the extension’s regular code. It ran when the editor loaded the extension, with no separate click required. Researchers say it collected information about the machine, attempted to add an attacker-controlled SSH public key, enable remote login and create a tunnel to an external server. The code also tried to persist across restarts.
Cursor says the step that enabled SSH access failed on most Mac and Windows computers because it required administrator privileges. The company also says the attacker’s server is now offline. Those points limit what is known about successful remote access; they do not establish that every other action failed. Cursor says the affected build was removed, further distribution blocked, and its VS Code marketplace temporarily shut down while it audited access, rotated keys and rebuilt the marketplace.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Marketplace Listing Matters
The incident matters because the malicious code arrived through a trusted extension listing, rather than an obvious imitation with a misspelled name. According to the source report and researchers, the update used the legitimate extension identifier. Users relying on automatic updates could have received it without knowingly installing a new tool. That makes the case a software supply-chain risk: familiar branding and a recognized distribution channel did not guarantee that this particular package was authentic.
Code editors often have access to project files and developer tools. Phorion said a backdoored extension can access local files, source code and tooling once its module loads. The reported attempt to place an SSH key and enable remote access raises the stakes beyond a misleading update, even though the sources do not establish how many users’ machines accepted those changes or whether the attacker successfully logged in.
For developers, the practical point is to check the installed version and follow the vendor’s incident guidance rather than assuming removal alone has reversed changes. Cursor’s estimate describes the possible audience, not the number of confirmed victims. That distinction matters when judging both the scale of the incident and the response needed on an individual machine.
Products Worth Considering
Apple MacBook Pro (14.2-inch, 2025) – M5 chip, 16GB Unified Memory, 1TB SSD, Space Black
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
The Release and Response Timeline
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 release listed, according to the source report’s check on Oct. 30. The report says 2.1.312 was published on GitHub on Oct. 27, while 2.1.314 appeared on Oct. 30. The suspect 2.1.313, by contrast, appeared in Cursor’s marketplace during the Oct. 29 incident window.
Cursor said it removed the modified package after detecting it, blocked further distribution and took its marketplace offline as a precaution. It later said it audited access, rotated keys and rebuilt the marketplace before bringing it back. The company has not publicly explained how the package was published under Anthropic’s extension identity.
Anthropic said its own systems and employee laptops were not compromised. According to the source material, the npm package and versions distributed through Microsoft’s Visual Studio Marketplace and Open VSX were not affected. Early reports naming Open VSX as the distribution source were corrected. The confirmed scope in the available statements is the Cursor marketplace listing.
“The modified extension was impacting at most 5,000 users.”
— Cursor
What Investigators Have Not Established
The main unanswered question is how the altered package was published under Anthropic’s name and extension identifier. Cursor has not publicly detailed the route used to submit or distribute it. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available statements do not explain what access was obtained or how.
It is also not clear how many people actually installed or loaded version 2.1.313, how many machines accepted the attempted SSH changes, or whether the attacker established a working remote session. Cursor’s figure is an estimate of maximum potential impact. The claim that SSH activation failed on most Mac and Windows systems does not resolve whether other parts of the code ran or what information may have been collected.
The public accounts differ on who first detected the incident: Cursor says it identified it, The Register credited Phorion with spotting it, and OpenSourceMalware thanked a developer for an alert. The available material does not settle that sequence. Cursor’s direct notifications and any later technical findings may clarify the scope.
Checks for Cursor Claude Code Users
Cursor users who had Claude Code installed should run Cursor’s recommended check for an SSH key labelled svc-telemetry. If it is present, the source report says uninstalling the extension is not enough: users should use Cursor’s cleanup scripts and consider rebuilding the affected machine. Cursor’s guidance should take precedence as it is updated.
Anyone who suspects exposure should change credentials from a different, trusted computer, rather than from the potentially affected device. That is a precaution, not confirmation that credentials were stolen. Users should also review their installed extension version and distribution source; the reported incident concerns Cursor’s marketplace, not the separate listings and package channels identified as unaffected in the available statements.
Cursor says it will contact affected users, but the source material does not specify when those notices will arrive or how the company will determine the recipient list. The next public developments to watch are further details about the marketplace access, Cursor’s user notifications and any revised guidance based on the investigation.
Key Questions
Which Claude Code version was affected?
The affected Cursor marketplace listing was version 2.1.313, which Cursor says was available for about 11 hours on Oct. 29. Anthropic’s public release list went from 2.1.312 to 2.1.314, according to the source report.
Does the incident mean Anthropic’s systems were breached?
No such breach is confirmed in the available statements. Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. The reported malicious build was distributed through Cursor’s marketplace.
What should affected Cursor users check?
Check for an SSH key labelled svc-telemetry, following Cursor’s published instructions. If it appears, the source report says to use Cursor’s cleanup scripts; uninstalling the extension alone may not remove changes made by the code.
Were users of other Claude Code distribution channels affected?
The source material says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected. The incident described involved the listing in Cursor’s marketplace; early reports naming Open VSX were corrected.
How many people were actually compromised?
That has not been established publicly. Cursor said at most 5,000 users may have been affected, but that figure is an upper estimate and does not confirm how many installed the package or experienced successful remote access.
Source: ThorstenMeyerAI.com
