🔍 Read the full analysis: Did You Install The Tampered Claude Code Update? Here’s What To Check on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A modified version of Anthropic’s Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. Cursor says up to 5,000 users may have been affected and will contact them; users should check for an SSH key labelled “svc-telemetry” and follow Cursor’s cleanup guidance if it is present.
A modified Claude Code extension was available in Cursor’s VS Code extension marketplace for about 11 hours on October 29, Cursor says, and may have reached as many as 5,000 users. The version, numbered 2.1.313, used Anthropic’s extension name and identifier but was not built by Anthropic; Cursor says it removed the release and will contact potentially affected users.
Cursor says version 2.1.313 was listed from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It removed the version after detecting the issue, blocked further distribution, and temporarily shut down its VS Code marketplace while it reviewed access, rotated keys and rebuilt the marketplace. Cursor has not published exact times for those follow-up steps.
Security analyses described a small malicious loader placed before the extension’s legitimate code. It could run when the editor loaded the extension, without the user opening Claude Code or clicking a prompt. Researchers said the code collected computer details and tried to add an attacker-controlled SSH key, enable remote login, create a tunnel to an attacker server and persist after restarts.
There is an important limitation to the reported attack: enabling SSH required administrator privileges. Cursor said that step failed on most Macs and Windows PCs, preventing remote access through the tunnel on those machines. The source material says the attacker’s server is now offline, but that does not establish that every attempted action failed or that an affected computer is safe.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Cursor Listing Matters
The incident affected a trusted software distribution route rather than relying only on a separate extension with a similar name. The modified release appeared under the real Claude Code listing and identifier, according to the cited reporting and security researchers. That meant users with extension auto-updates could receive it without deliberately selecting an unfamiliar add-on.
Developer extensions can operate within the environment where source code, local files and development tools are available. Researchers said the loader ran as the extension loaded, which makes the incident relevant even to users who did not knowingly launch Claude Code during the exposure window. The attempt to establish SSH access is also significant because it sought a way to persist beyond the initial extension run, although the reported administrator-rights barrier limited that step on most Macs and Windows PCs.
The reported maximum of 5,000 users is Cursor’s estimate, not a count of confirmed compromised machines. The distinction matters: installation or exposure does not by itself prove an attacker gained remote access, while failure of the SSH step does not rule out the other behavior described by researchers.
Popular right now
Dyson V8 Cyclone Cordless Vacuum
Sony BRAVIA 5 85-Inch Mini LED 4K HDR Smart TV (K-85XR50)
Ninja Foodi 10-Qt DualZone Smart XL Air Fryer, 6-in-1, DZ550
As an affiliate, we earn on qualifying purchases.
How the Version Reached Cursor
The compromised release was distributed through Cursor’s VS Code extension marketplace. Cursor’s account places the start of availability at 2:27 a.m. Pacific time on October 29 and its removal at 1:35 p.m. that day. Anthropic’s official GitHub release history went from version 2.1.312 to 2.1.314, with no official 2.1.313 entry listed when checked on October 30.
Anthropic said its own systems were not compromised and that its official channels were not affected. The source material also identifies the Microsoft Visual Studio Marketplace, Open VSX and the npm package as unaffected. Early reports that named Open VSX as the distribution source were corrected; the reported source was Cursor’s marketplace.
Cursor says it identified the issue, removed the build and took steps to restore its marketplace. Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic systems or employee laptops. The available accounts do not settle how the modified build was published under Anthropic’s extension identity.
““impacting at most 5,000 users””
— Cursor
What Investigators Have Not Established
How the modified release entered Cursor’s marketplace remains unexplained in the available statements. Cursor has not publicly detailed the method used to publish it under Anthropic’s extension identity. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the source material does not provide further detail about that access or who obtained it.
The public information also does not give a confirmed number of installations, identify how many users’ machines ran the loader, or establish how many systems had the SSH step succeed. Cursor’s figure is an upper estimate of possible impact. The server being offline and the reported failure of SSH activation on most Macs and Windows PCs do not, on their own, confirm that every exposed system is clean.
Reports differ on who first noticed the incident: Cursor says it identified it, The Register credits Phorion, and OpenSourceMalware acknowledged a developer who alerted it. The available record does not resolve that sequence.
Checks for Cursor Claude Code Users
Cursor users who installed or updated Claude Code through its marketplace during the exposure window should run Cursor’s check for a key labelled “svc-telemetry.” The source material advises that uninstalling the extension alone is not enough if the key is present: users should use Cursor’s cleanup scripts, consider rebuilding the machine, and change credentials from a different, trusted computer. Follow Cursor’s current security notice for the exact commands and instructions; do not run scripts copied from unverified sources.
Cursor says it will contact potentially affected users directly. Users should watch for that notice and for further instructions from Cursor and Anthropic. The available reporting does not provide a complete incident count or a confirmed explanation of how the marketplace listing was altered, so the companies’ follow-up findings may change what users are advised to do.
Key Questions
Which Claude Code version was affected?
The reported tampered build was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s official release history listed version 2.1.312 before the incident and 2.1.314 afterward.
Was the extension available outside Cursor?
The source material says the Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports identifying Open VSX as the source were corrected; the reported distribution channel was Cursor’s marketplace.
How can I check whether my system may be affected?
If you used Claude Code through Cursor, run Cursor’s check for a key labelled “svc-telemetry.” If it is present, follow Cursor’s cleanup guidance. Uninstalling the extension alone is not described as sufficient.
Does installing the extension prove my computer was compromised?
No. Cursor’s figure of up to 5,000 users is a maximum potential reach, not a confirmed count of compromised devices. Researchers described malicious code that could run when the extension loaded, but the available information does not establish which actions succeeded on each system.
Did Anthropic’s systems get breached?
Anthropic said its own systems and employee laptops were not compromised and that its official distribution channels were unaffected. The reported incident involved a modified listing in Cursor’s marketplace; how it was published there remains unclear.
Source: ThorstenMeyerAI.com
