🔍 Read the full analysis: Was The Claude Code Update You Saw Tampered With? Check These Details on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its VS Code extension marketplace for about 11 hours on Oct. 29 and may have reached up to 5,000 users. The code attempted to establish remote access and collect machine information; Cursor and Anthropic say the incident did not compromise Anthropic’s systems. Cursor users should check for the SSH key labelled svc-telemetry and follow Cursor’s cleanup guidance if it is present.
Cursor says a tampered version of Anthropic’s Claude Code extension was available in its VS Code extension marketplace for about 11 hours on Oct. 29, potentially reaching up to 5,000 users. The modified version, numbered 2.1.313, carried the extension’s usual name and identifier but was not built by Anthropic, according to Cursor and security researchers. Its code attempted to collect information about computers and set up remote access.
Cursor’s notice says version 2.1.313 was available from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29. The company says it removed the build when it detected the incident, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor later audited marketplace access, rotated keys, rebuilt the marketplace and restored it. It has not publicly detailed the timing of those follow-up steps.
Security analyses by Phorion and OpenSourceMalware describe a small loader placed before the extension’s legitimate code. OpenSourceMalware counted a 66-line block in the main file. The extension could run when the editor loaded it, without a user opening Claude Code or clicking a prompt. Researchers say the code gathered computer details, added an attacker-controlled SSH public key, attempted to enable remote login and opened a tunnel to an attacker’s server.
Cursor says the step to enable SSH required administrator permissions and failed on most Mac and Windows computers, limiting the attacker’s ability to log in through that route. The source material says the attacker’s server is now offline, but that does not establish that every attempted action failed. Cursor recommends checking for an SSH key labelled svc-telemetry. If it is present, Cursor says users should use its cleanup scripts; the source also advises considering a machine rebuild and changing credentials from a different, trusted computer.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why a Trusted Extension Channel Matters
The incident matters because the altered software appeared as an update to the real extension listing, rather than as an obvious copycat with a similar name. Cursor users who had automatic extension updates enabled could have received it without knowingly installing a separate program. A familiar name and identifier, on their own, were not proof that this particular build came from Anthropic.
Code editor extensions can have access to local files, source code and developer tools. A malicious extension may therefore put both a user’s computer and work-related material at risk. The reported limit of up to 5,000 potentially affected users is Cursor’s estimate; it does not say how many devices actually received or ran the modified build. The attempted SSH changes also do not, by themselves, confirm that an attacker gained remote access.
For affected users, checking the machine and removing any persistence are separate from simply uninstalling the extension. Credentials changed on a potentially affected computer could be exposed, which is why the supplied guidance recommends changing them from a trusted device. Those are precautionary steps, not evidence that every user’s files or accounts were accessed.
Products Worth Considering
Dell UltraSharp U4025QW 40 5K2K WUHD Curved LED Monitor (21:9)
Apple MacBook Pro 14.2-Inch Laptop, M2 Pro 12-Core CPU, 16GB Memory, 1TB SSD, 19-Core GPU, Space Gray
Apple MacBook Neo 13-inch Laptop with A18 Pro Chip, 8GB Memory, 256GB SSD, Liquid Retina Display, and 1080p Camera — Blush
As an affiliate, we earn on qualifying purchases.
How Version 2.1.313 Entered the Timeline
Anthropic’s public GitHub release history went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 release listed as of Oct. 30, according to the source material. The altered 2.1.313 was distributed through Cursor’s VS Code extension marketplace, not presented as an official Anthropic release. Cursor says the listing carried the identity of Anthropic’s Claude Code extension.
Anthropic released version 2.1.314 on Oct. 30. A member of Anthropic’s technical staff later said the event was not a compromise of Anthropic’s systems or employee laptops. Anthropic also said its official channels were not affected. Early reports that named Open VSX were corrected; the source material says versions from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected.
Public accounts differ on who first identified the malicious build. Cursor says it identified the incident, The Register credited Phorion with spotting it, and OpenSourceMalware thanked a developer who alerted the group. The available reporting does not resolve that timeline.
“The modified extension was impacting at most 5,000 users.”
— Cursor
What the Investigation Has Not Established
How the modified build was published under Anthropic’s extension identity remains unexplained. Cursor has not publicly described how the marketplace listing was altered or which account or process was used. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but that wording does not explain the access method or establish who was responsible.
It is also unclear how many people installed or ran version 2.1.313, whether any attacker obtained access to a computer, or whether information collected by the code was used. Cursor’s estimate of up to 5,000 users is not a confirmed number of infected machines. The reporting says SSH activation failed on most Macs and Windows PCs and the attacker’s server is offline, but does not provide a complete account of outcomes across all affected systems.
The source material reports that Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected. It does not provide independent technical findings for every distribution channel. Reports identifying Open VSX as the source were corrected, so users should distinguish the affected Cursor marketplace listing from those other channels.
Checks Cursor Users Should Run
Cursor users who installed or updated Claude Code through its marketplace during the affected window should check for the SSH key labelled svc-telemetry and follow Cursor’s published guidance. If they find the key, the source advises using Cursor’s cleanup scripts rather than relying on uninstalling the extension alone. Users should consider rebuilding the machine and changing passwords, tokens and other credentials from a separate, trusted computer if their device may have run the modified build.
Cursor says it will contact affected users directly. Users should watch for that notice and rely on Cursor’s official security guidance for cleanup instructions. Anthropic released version 2.1.314 on Oct. 30, but installing a later version does not by itself show whether an earlier build ran on a particular computer or remove any changes it may have made.
The next important public details would be Cursor’s account of how the build entered its marketplace, the results of its access review and any further findings about installations or data exposure. Until those are available, the safest distinction is between potential exposure, which Cursor estimates could involve up to 5,000 users, and confirmed remote access, which the source material does not establish.
Key Questions
Which Claude Code version was affected?
The modified build was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public GitHub release list went from 2.1.312 to 2.1.314, with no official 2.1.313 release listed as of Oct. 30.
When was the tampered extension available?
Cursor says it was available on Oct. 29 from 2:27 a.m. to 1:35 p.m. Pacific time, about 11 hours. Cursor’s estimate of up to 5,000 users refers to potential impact, not a verified number of installations.
How can I check whether my computer may be affected?
If you used Claude Code through Cursor’s marketplace during that window, check for an SSH key labelled svc-telemetry and consult Cursor’s security notice. If the key is present, follow Cursor’s cleanup instructions; uninstalling the extension alone may not address changes the code attempted to make.
Was Anthropic’s own software distribution compromised?
Anthropic said its systems and official channels were not compromised, and a member of its technical staff said employee laptops were not involved. The reported malicious build was distributed through Cursor’s marketplace; the source material says Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected.
Did the attacker gain access to affected computers?
The available information does not establish that the attacker successfully accessed any particular computer. Cursor says the attempt to enable SSH required administrator rights and failed on most Macs and Windows PCs, but it has not published a confirmed count of installations, successful logins or exposed data.
Source: ThorstenMeyerAI.com
