🔍 Read the full analysis: The Claude Code Update Looked Right. The Code Wasn’t. on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s marketplace for about 11 hours on October 29, according to Cursor. The company says at most 5,000 users were affected; researchers reported that the build attempted to establish persistent remote access. Cursor and Anthropic say their own systems were not compromised, but the method used to publish the extension under Anthropic’s identity has not been explained.
A modified Claude Code extension was available through Cursor’s VS Code marketplace for about 11 hours on October 29, and Cursor says at most 5,000 users may have received it. The build used Anthropic’s extension name and identifier but was not developed by Anthropic, according to Cursor and security researchers; their analyses say it attempted to collect device information and establish remote access.
Cursor says version 2.1.313 appeared in its marketplace at about 2:27 a.m. Pacific time and was removed at about 1:35 p.m. The company said it blocked further distribution, temporarily shut down its VS Code marketplace as a precaution, audited access, rotated marketplace keys and rebuilt the service before bringing it back online. Cursor has not published a detailed timeline for those later steps.
Researchers at Phorion and OpenSourceMalware described a small loader placed ahead of the extension’s legitimate code. OpenSourceMalware said the loader ran when the editor loaded the extension, without requiring users to open Claude Code or click a prompt. Their analyses said it collected information about the computer, added an attacker’s SSH public key, attempted to enable remote login and opened a tunnel to an attacker-controlled server. The code also sought to persist across restarts.
Cursor said enabling SSH required administrator privileges and that this step failed on most Macs and Windows computers. That limited one route to remote access, but did not erase other reported actions: the key, startup entries and a data report were still created or sent, according to the source account. The attacker’s server is now offline, the source material says. Users who installed the extension should not treat that as proof that a computer or its credentials are safe.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Can Carry Risk
The incident shows how a compromised or abused distribution channel can make a malicious update appear to come from a trusted software listing. The build was reportedly published under the real extension identity, rather than as a similarly named imitation. Users with automatic extension updates enabled could have received it without taking a separate action, security researcher Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News.
That matters to developers because editor extensions can access local files, source code and development tools when loaded. A developer workstation may also contain account credentials, private code and access to build or deployment systems. The reporting does not establish that any such material was used to access another service, but the attempted persistence and remote-access steps make exposure more serious than a misleading listing alone.
Cursor’s estimate of at most 5,000 affected users is a company figure, not a confirmed count of infected machines or successful remote logins. The distinction matters: the number of users who could have received the build does not establish how many systems completed the malicious actions or what data, if any, was taken.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
A Brief Window in Cursor’s Store
The last official Claude Code release before the incident was version 2.1.312, published by Anthropic on GitHub on October 27, according to the source material. The altered 2.1.313 appeared in Cursor’s marketplace two days later. Anthropic’s public release list then moved to version 2.1.314 on October 30, with no 2.1.313 entry listed there when checked that day.
The exposure described here concerns Cursor’s VS Code extension marketplace. Cursor and researchers said the Claude Code extension from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected. Early reports that named Open VSX were corrected, according to the source material. Those distinctions are important because the extension name alone does not identify which distribution channel supplied a copy.
Cursor said it removed the build after detection and took its marketplace offline while it reviewed and rebuilt the service. On October 30, the company posted that the incident could have affected up to 5,000 users. Anthropic staff member Felix Rieseberg later said the incident was not a compromise of Anthropic’s systems or employee laptops.
“The modified extension was “impacting at most 5,000 users.””
— Cursor
How the Listing Was Compromised
The central unanswered question is how version 2.1.313 appeared under Anthropic’s extension identity in Cursor’s marketplace. Cursor has not publicly explained the publishing route. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but that wording does not establish whether an account, credential, publishing process or other part of the marketplace was involved.
The public information also does not identify who first detected the build. Cursor says it identified the incident; The Register credited Phorion with spotting it, while OpenSourceMalware thanked a developer who alerted the group. The sequence has not been settled in the available accounts.
It remains unclear how many systems received the extension, whether any attacker-controlled remote login succeeded, and what data was transmitted or accessed. Cursor’s statement that SSH activation failed on most Macs and Windows PCs is not a claim that it failed on every device. The source material gives no confirmed total for successful compromises or stolen information.
Checks for Cursor Claude Code Users
Cursor users who had Claude Code installed during the exposure window should check Cursor’s security notice and use its specified check for a key labelled svc-telemetry. The source material warns that uninstalling the extension alone is not sufficient if the malicious changes were made. Users who find the key are directed to Cursor’s cleanup scripts; they may also need to consider rebuilding the machine and changing credentials from a different, trusted computer.
These steps are precautionary guidance reported in the source material, not confirmation that every affected user must rebuild a device. Users should follow Cursor’s current instructions and contact the company if they need help determining exposure. Changing passwords or other credentials from a potentially affected machine could leave them exposed, which is why the source recommends using a separate trusted device.
The next major development should be a fuller account of how the extension was published and what Cursor’s review found. Cursor has said it audited marketplace access and rotated keys, but the available reporting does not include a public explanation of the entry point or a final incident count. Anthropic’s statement that its own systems were not compromised does not resolve how its extension identity was used in Cursor’s store.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 was available in Cursor’s extension marketplace for about 11 hours on October 29. Cursor said the build was not developed by Anthropic and could have reached at most 5,000 users.
What did the modified extension try to do?
Security researchers said it attempted to collect device information, add an SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts. The available reporting does not confirm that every step succeeded on every computer.
Does this affect Claude Code from other marketplaces?
The source material says the extension from Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected. The incident described concerns Cursor’s VS Code marketplace; early reports naming Open VSX were corrected.
What should a Cursor user do?
Check Cursor’s security guidance for a key labelled svc-telemetry. If it is present, the source advises using Cursor’s cleanup scripts and changing credentials from a separate, trusted computer; uninstalling the extension alone may not remove other changes.
How many users were actually compromised?
That is not known from the available reporting. Cursor said at most 5,000 users may have been affected, but that figure is not a confirmed count of successful compromises or data theft.
Source: ThorstenMeyerAI.com
