🔍 Read the full analysis: A Claude Code Update Reached Up To 5,000 Cursor Users—Here’s What To Review on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A tampered Claude Code version, 2.1.313, was distributed through Cursor’s extension marketplace for about 11 hours on October 29. Cursor says up to 5,000 users may have been affected and plans to contact them; users should check for the SSH key labeled svc-telemetry and follow Cursor’s cleanup guidance if it is present.
A tampered Claude Code extension was available in Cursor’s VS Code extension marketplace for about 11 hours on October 29, and Cursor says up to 5,000 users may have received it. The build used the real extension name and identifier but was not made by Anthropic; it attempted to collect device information and establish remote access, making the incident a supply-chain risk for Cursor users.
Cursor said the modified version 2.1.313 appeared in its marketplace at 09:27 UTC and was removed at 20:35 UTC. The company said it blocked further distribution, shut down its VS Code marketplace as a precaution, audited access, rotated keys, rebuilt the marketplace and restored it. Cursor has not published the timing of each response step.
Security researchers described a loader placed ahead of the extension’s legitimate code. It ran when the editor loaded the extension, without requiring the user to open Claude Code or click a prompt. According to the source report’s accounts of the analyses, the code gathered information about the computer, attempted to add an attacker-controlled SSH public key, enable remote login, open a tunnel to an attacker’s server and persist across restarts.
The attempt to enable SSH required administrator privileges. Cursor said this part failed on most Mac and Windows machines, limiting the attacker’s ability to log in through the tunnel on those systems. That does not mean the other actions failed: the report says the key, startup entries and a data report were still written. Cursor also said the attacker’s server is now offline. Users should check for a key labeled svc-telemetry; the source advises that removing the extension alone is insufficient if the key is present.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Updates Need Review
The incident matters because the malicious build arrived as an update to the genuine extension listing, rather than as an obvious copy with a misspelled name. Users who had automatic extension updates enabled could have received it without taking a separate action. A familiar publisher name and extension identifier did not establish that this particular build was authentic.
Code editors can grant extensions access to local files, source code and developer tools. For developers, that can put both personal credentials and work projects at risk. The report says the malicious code attempted to create a route for remote access, although administrator permissions blocked that step on most affected Macs and Windows PCs. The available information does not establish how many users installed the update, whether any information was used, or whether an attacker successfully accessed a machine.
The reported maximum of 5,000 potentially affected users is an upper bound, not a confirmed count of compromised devices. Cursor says it will contact users directly. People who installed or updated Claude Code in Cursor during the exposure window should treat the check as a security precaution, even if they do not know whether the update reached their machine.
Popular right now
Shark HydroVac MessMaster Corded Wet/Dry Vacuum, Mop & Self-Clean (WD161)
Ninja DualZone Air Fryer 10 Qt Smart 6-in-1 Grey (DZ950)
Ninja Hot & Iced XL Coffee Maker with Rapid Cold Brew, Black, CM371
As an affiliate, we earn on qualifying purchases.
How the False Update Was Distributed
The timeline in the source report places Anthropic’s last official release before the incident at version 2.1.312, published on GitHub on October 27. Cursor’s marketplace then offered the modified 2.1.313 from 09:27 to 20:35 UTC on October 29. Anthropic released version 2.1.314 on October 30; its public release list skipped 2.1.313.
The source report says the affected listing carried the identifier anthropic.claude-code and that Cursor named altered builds for Apple-silicon Macs and 64-bit Windows. It also says early reports incorrectly identified Open VSX as a distribution source and were corrected. According to the companies and researchers cited in the report, Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected.
Anthropic’s technical staff member Felix Rieseberg said the event was not a compromise of Anthropic’s systems or employee laptops. Anthropic’s position, as reported, was that a malicious actor “used access to Cursor’s marketplace.” Cursor has not publicly explained how the modified build was published under Anthropic’s extension identity.
“The modified extension was impacting at most 5,000 users.”
— Cursor
How Marketplace Access Was Gained
The public information does not explain how the attacker published a modified build under Anthropic’s extension identity, or what access was used. Cursor has not provided a public account of the entry point. Anthropic’s statement that the actor used access to Cursor’s marketplace does not identify how that access was obtained.
It is also unclear how many users actually received or loaded version 2.1.313, whether data collected by the code was transmitted or used, and whether any machine was accessed remotely. Cursor’s figure of up to 5,000 is a maximum estimate. The source report says the attacker’s server is offline, but that alone does not establish what happened to information collected before it went offline.
Checks for Cursor Claude Code Users
Cursor says it will contact affected users directly. Anyone who used Claude Code in Cursor during the exposure window should check Cursor’s published guidance for the key labeled svc-telemetry. If it is present, the source report advises using Cursor’s cleanup scripts rather than relying on uninstalling the extension alone. It also recommends considering a rebuild of the machine and changing credentials from a different, trusted computer.
Users should follow current instructions from Cursor and avoid treating the extension’s removal as proof that a system is clean. Further updates from Cursor may clarify how the listing was altered, how the company determined the potential user count and whether its investigation found evidence of data exposure or successful remote access.
Key Questions
Which Claude Code version was affected?
The modified build was labeled version 2.1.313 and appeared in Cursor’s VS Code extension marketplace on October 29. Anthropic’s preceding official release was 2.1.312, and its next listed release was 2.1.314.
How can Cursor users check for signs of the incident?
Check Cursor’s security guidance for the SSH key labeled svc-telemetry. If it is present, follow Cursor’s cleanup instructions; according to the source report, uninstalling the extension by itself is not enough.
Does the reported 5,000 figure mean 5,000 computers were compromised?
No. Cursor described up to 5,000 users as potentially affected. That is an upper estimate, not a confirmed count of devices that were infected or accessed.
Were Claude Code users outside Cursor affected?
The source report says the Claude Code releases distributed through Microsoft’s Visual Studio Marketplace, Open VSX and npm were not affected. The reported exposure was in Cursor’s extension marketplace.
Has Cursor explained how the modified update was published?
Not in the information available in the source report. Cursor has not publicly described how the attacker gained the ability to publish under Anthropic’s extension identity.
Source: ThorstenMeyerAI.com
