🔍 Read the full analysis: The Right Name, The Wrong Code: Reviewing The Claude Code Update on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor. The company says at most 5,000 users may have received it; the build attempted to establish remote access and collect machine information. Cursor and Anthropic say their own systems were not compromised, but how the malicious version was published under Anthropic’s extension identity remains unknown.
Cursor says a maliciously modified Claude Code extension was available in its marketplace for about 11 hours on October 29, under the genuine extension name and identifier. The build, version 2.1.313, was not made by Anthropic and attempted to collect information from affected computers and establish remote access, according to Cursor and security researchers, in a case that highlights coding-agent security risks. Cursor estimates that at most 5,000 users may have been affected.
Cursor said the version was available from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC). It removed the build after detecting the issue, blocked further distribution and temporarily shut down its VS Code extension marketplace. Cursor said it audited access, rotated keys, rebuilt the marketplace and restored it. The company has not published the timing of each response step.
Analyses by security firms Phorion and OpenSourceMalware, alongside Cursor’s notice, describe a loader placed before the extension’s normal code, similar to the malicious behavior detailed in another Claude agent code-injection report. Researchers said it ran when the editor loaded the extension, without requiring the user to open Claude Code or click a prompt—a behavior relevant to discussions about whether developers need a mental model of Claude Code. The modified build attempted to gather computer details, add an attacker-controlled SSH public key, enable remote login and open a tunnel to an external server. Researchers also reported that it tried to persist after restarts.
Cursor said the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That would limit the attacker’s ability to log in through the tunnel on those machines, but it does not establish that no other actions succeeded. Cursor said the attacker’s server is now offline. Its estimate of users potentially affected is a maximum, not a confirmed count of infected or accessed computers.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Distribution Matters
The incident highlights the risk of trusting an extension based on its name and identifier alone. The modified build appeared as an update to the legitimate Claude Code listing, rather than as an obvious imitation, according to the source report. Users with automatic extension updates could have received it without taking a separate action.
For developers, an editor extension can run with access to local files, source code and development tools. A compromised extension can therefore expose more than the assistant’s own data: it may put project materials and credentials stored on the workstation at risk. In this case, researchers described attempted SSH access and information collection, while the success and reach of those actions remain unknown.
The event also puts attention on the marketplace as a software supply-chain link. Cursor operates the store where the build appeared, while Anthropic publishes Claude Code through other distribution channels. Cursor’s takedown and marketplace rebuild addressed its store, but the public information does not yet explain how the malicious version was accepted under the genuine extension identity.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W
As an affiliate, we earn on qualifying purchases.
The Release and Store Timeline
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 release listed, according to the source report’s check on October 30. Version 2.1.312 was published on GitHub on October 27; Anthropic released 2.1.314 early on October 30. That gap is consistent with Cursor’s account that the marketplace version was not an official Anthropic build.
Cursor said it found the modified extension in its VS Code extension marketplace. The source report says early accounts that named Open VSX were corrected, and that the npm package and Claude Code versions from Microsoft’s Visual Studio Marketplace and Open VSX were not affected, according to the companies and researchers cited. The incident was reported by security firms and news outlets on October 30.
Public accounts differ on who first spotted the malicious build. Cursor said it identified the incident; The Register credited Phorion with first spotting it, while OpenSourceMalware thanked a developer who alerted the firm as the event unfolded. The available reporting does not settle that sequence.
“The modified extension impacted at most 5,000 users.”
— Cursor
How the Malicious Build Was Published
Cursor has not explained how the modified extension entered its store under Anthropic’s identity. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the public statements cited do not say how that access was obtained or whether the actor compromised a publishing account, exploited a process weakness or used another route.
It is also unclear how many users installed or ran the extension, what information—if any—was sent successfully, and whether any machines were accessed remotely. Cursor’s maximum exposure estimate and the reported failure of the SSH-enabling step on most Macs and Windows PCs do not answer those questions for every affected device. The report says the attacker’s server is offline, but that does not establish whether data was collected before it went down.
Cursor’s response says it audited access and rotated keys, but the company has not released a detailed incident timeline or a public account of the investigation’s findings. The source material also does not establish the exact number of users contacted or the status of every potentially affected installation.
Checks for Cursor Extension Users
Cursor users who installed Claude Code through its marketplace should follow Cursor’s current security instructions and check for the SSH key labelled “svc-telemetry”, as described in the source report. If it is present, the report says uninstalling the extension alone is not sufficient: users should use Cursor’s cleanup scripts. Cursor’s guidance should take precedence if it has since issued updated instructions.
Where there is evidence of exposure, the source recommends considering a rebuild of the computer and changing credentials from a different, trusted device. Users should treat affected development credentials and access keys as potentially exposed until they have followed the vendor’s remediation advice. The available material does not say that every user who downloaded the version needs to rebuild a machine; the response depends on what was installed and what the checks show.
The next public milestones are a fuller explanation from Cursor of how the build passed through its marketplace and any updated findings about affected users or successful access. Until then, the user count and extent of any data exposure remain unsettled.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version 2.1.313 appeared in Cursor’s extension marketplace on October 29 under the genuine Claude Code name and identifier. Cursor says it was not developed by Anthropic and removed it after detecting the issue.
How many users may have received the malicious build?
Cursor said at most 5,000 users may have been affected. That is an upper estimate of potential exposure, not a confirmed count of installations or compromised computers.
What did the modified extension try to do?
Researchers said it attempted to collect computer details, add an attacker-controlled SSH key, enable remote login and create a tunnel to an external server. Cursor said the SSH-enabling step failed on most Macs and Windows PCs, but the success of other actions is not fully known.
Were Anthropic’s systems or other Claude Code channels affected?
Anthropic said its systems and employee laptops were not compromised. The source report says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected; the tampered build was distributed through Cursor’s marketplace.
What should a Cursor user do now?
Check Cursor’s current security notice and look for the SSH key labelled “svc-telemetry.” If it is present, follow Cursor’s cleanup instructions; the source report says uninstalling alone is not enough. Consider changing credentials from a separate trusted computer and rebuilding the machine if warranted by the findings and vendor guidance.
Source: ThorstenMeyerAI.com
