🔍 Read the full analysis: How To Spot Whether Your Claude Code Update Was Tampered With on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was distributed through Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor and security researchers. Cursor says up to 5,000 users may have received it; affected users should check for an SSH key labeled svc-telemetry and use the vendor’s cleanup guidance if it is present.
Cursor’s extension marketplace distributed a tampered version of Anthropic’s Claude Code extension for about 11 hours on October 29, Cursor and security researchers say. The build used the legitimate extension’s name and identifier, and Cursor estimates that up to 5,000 users may have been affected; anyone who installed or updated it in Cursor should check their system for signs of the attempted compromise.
The affected release was labeled version 2.1.313 of the extension identified as anthropic.claude-code. According to Cursor, it was available from about 2:27 a.m. until 1:35 p.m. Pacific time on October 29. Cursor says it removed the build after detecting the incident, blocked further distribution, and temporarily shut down its VS Code extension marketplace while it reviewed access, rotated keys and rebuilt the marketplace.
Analyses by Phorion and OpenSourceMalware describe a small loader placed ahead of the extension’s normal code. Researchers say it ran when the extension loaded, without requiring a user to open Claude Code or click a prompt. The malicious code attempted to collect information about the computer, add an attacker-controlled SSH public key, enable remote login, open a connection to an outside server and create persistence across restarts.
Cursor says the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers, limiting remote access through that route. That does not mean no changes occurred: the sources say the key, startup entries and a data report could still have been written. Cursor says the attacker’s server is now offline. It recommends that users check for a key labeled svc-telemetry and follow its cleanup instructions if found.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Store Trust Failed
The incident matters because the malicious build appeared as an update to the real extension listing, rather than as a misspelled imitation. Users who rely on automatic updates could have received it without taking a separate action. The episode shows that a familiar name and identifier do not, on their own, establish that a particular package was produced by the named developer.
Code editors and their extensions can access files, source code and developer tools available to the user. A compromised extension can therefore expose sensitive work or create a route for later access. In this case, the reported administrator-rights barrier appears to have limited one part of the attack on many machines, but it does not erase the risk from other actions the code may have completed.
For affected users, uninstalling the extension alone may not remove changes made elsewhere on the computer. Cursor’s guidance calls for dedicated cleanup scripts when the suspicious key is found; users may also need to rebuild a machine and change credentials from a separate trusted device, depending on their circumstances and the vendor’s instructions.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Release and Marketplace Timeline
Anthropic’s public release history lists version 2.1.312 on October 27, followed by version 2.1.314 on October 30. The public list skips 2.1.313, the version associated with the malicious Cursor marketplace package. That is consistent with the source material’s distinction between Anthropic’s official release and the modified build distributed through Cursor.
Cursor says the package was removed and its marketplace taken offline as a precaution before the service was rebuilt. Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. Anthropic also said its official distribution channels were not affected. Security reports initially naming Open VSX as a source were corrected; the supplied reporting says the affected distribution was Cursor’s marketplace, not Open VSX, Microsoft’s Visual Studio Marketplace or the npm package.
The available accounts do not identify who first detected the package. Cursor said it identified the incident, while other reports credited security researchers or a developer who alerted them. The precise discovery sequence has not been made public.
“The modified extension was impacting at most 5,000 users.”
— Cursor
How the False Build Was Published
The central unanswered question is how the modified package appeared under Anthropic’s extension identity in Cursor’s marketplace. Cursor has not publicly explained the publishing path or identified the account or process involved. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the supplied material does not establish how that access was obtained.
Cursor’s figure of up to 5,000 is an upper estimate of users who may have been affected, not a confirmed number of successful compromises. Public information also does not specify how many devices received the package, what data was transmitted from each, or how often the attempted SSH changes succeeded. Cursor says the server is offline, but the public accounts do not provide a complete incident-forensics report.
Checks for Cursor Claude Code Users
Cursor users who had Claude Code installed or updated through its marketplace during the incident window should run Cursor’s check for the key labeled svc-telemetry. If the key is present, follow Cursor’s cleanup scripts rather than relying only on uninstalling the extension. Users should review Cursor’s current security notice for device-specific steps and consider rebuilding a machine if its instructions or their security needs warrant it.
People who suspect their device was affected should change relevant credentials from a different, trusted computer, as the source guidance advises. Cursor and Anthropic may provide further details about the publishing path, affected-user notifications and remediation as their investigations continue. Until then, users should treat the 5,000 figure as a stated maximum and the scope of successful access as unresolved.
Key Questions
Which Claude Code version was involved?
The modified extension was labeled version 2.1.313 and appeared in Cursor’s marketplace. Anthropic’s public release list goes from 2.1.312 to 2.1.314, according to the supplied reporting.
How can Cursor users check for the reported change?
Run Cursor’s security check for an SSH key labeled svc-telemetry. If it appears, follow Cursor’s cleanup instructions; uninstalling the extension alone may not remove system changes.
Does finding the extension on a computer prove it was remotely accessed?
No. Cursor says the code attempted several actions, and that enabling SSH failed on most Macs and Windows PCs because it required administrator rights. The available information does not confirm successful remote access on every affected machine.
Were other Claude Code distribution channels affected?
The supplied reporting says the affected package came from Cursor’s marketplace. It identifies the Microsoft Visual Studio Marketplace, Open VSX and the npm package as not affected, and says early reports naming Open VSX were corrected.
How did the tampered build get into Cursor’s marketplace?
That has not been publicly explained. Anthropic said a malicious actor used access to Cursor’s marketplace, while Cursor has not described how the package was published under the extension’s identity.
Source: ThorstenMeyerAI.com
