TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Cursor says a modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29, 2026, and may have reached at most 5,000 users. The code attempted to collect system details and establish persistent remote access; whether it succeeded depends in part on the machine’s permissions. Cursor and Anthropic have not explained how the build was published under Anthropic’s extension identity.
Cursor’s extension marketplace distributed a tampered Claude Code update for about 11 hours on October 29, potentially reaching up to 5,000 users, the company said. The modified version, labeled 2.1.313, used Anthropic’s extension name and identifier, and researchers say its code attempted to establish remote access to affected computers.
Cursor said version 2.1.313 was available from 09:27 to 20:35 UTC on October 29. The company said the build was not developed by Anthropic, removed it after detection and blocked further distribution. Cursor later shut down its VS Code extension marketplace while it audited access, rotated keys and rebuilt the service, according to its account.
Researchers who analyzed the code said it ran when the editor loaded the extension. It attempted to collect information about the computer, add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and create startup entries to persist after restarts. Those actions were attempts; their presence in the code does not establish that every step succeeded on every affected computer.
Cursor said the SSH-enabling step required administrator privileges and failed on most Macs and Windows PCs. That would limit the attacker’s ability to log in through the tunnel on those systems, but Cursor’s statement does not mean the other attempted actions failed. Cursor said it will contact affected users directly. The attacker’s server was reported offline by the time the source material was published.
Could The Tampered Claude Code Update Have Reached Your Cursor Setup?
A modified Claude Code extension appeared in Cursor’s marketplace for about 11 hours. Here’s what is known about the build, what it attempted, and the checks Cursor users should take.
A trusted listing carried an untrusted build
Cursor said it found and removed the modified extension, then shut down its marketplace while auditing access, rotating keys, and rebuilding the service.
Published through Cursor
The affected package was available in Cursor’s VS Code extension marketplace. Early reports naming Open VSX were corrected.
Familiar name and identifier
The modified version reportedly used Claude Code’s real extension name and identifier, making the listing look routine.
Could arrive without a new install
Users with automatic extension updates enabled could have received the build without taking a separate installation step.
Reach is not the same as impact. “Up to 5,000 users” is Cursor’s maximum estimate. The available account does not confirm downloads, code execution, privilege grants, data collection, or successful remote logins for individual devices.
The version gap separates the marketplace build
Anthropic’s public release list showed 2.1.312 before the incident and 2.1.314 afterward. That supports the distinction, but does not explain how the altered package was uploaded.
What companies said
Anthropic technical staff member Felix Rieseberg said Anthropic systems and employee laptops were not compromised.
Anthropic said a malicious actor “used access to Cursor’s marketplace,” according to the source material.
What remains unanswered
Cursor and Anthropic had not publicly explained how the build was published using Anthropic’s extension identity.
Researchers reported no indication that Microsoft’s Visual Studio Marketplace, Open VSX, or the npm package was affected.
Researchers described a chain of attempted actions
The code reportedly ran when the editor loaded the extension. Its presence shows intent; it does not prove each action completed on every machine.
Gather system details
Attempted to collect information about the computer.
Add an SSH key
Attempted to add an attacker-controlled key labeled svc-telemetry.
Enable remote access
Attempted to turn on remote login and open a tunnel to an attacker server.
Persist after restart
Attempted to create startup entries so changes could survive reboots.
Privilege limits matter. Cursor said the SSH-enabling step required administrator privileges and failed on most Macs and Windows PCs. That statement does not establish whether other attempted actions succeeded.
Known, estimated, and still unclear
Keep the reported actions separate from verified outcomes when assessing exposure.
| Question | Available information | Status |
|---|---|---|
| When was it available? | October 29, 09:27–20:35 UTC, according to Cursor. | Reported by Cursor |
| How many users? | Cursor said potentially up to 5,000 users; this is not a confirmed download or infection count. | Maximum estimate |
| Did remote login succeed? | The SSH step required administrator privileges and reportedly failed on most Macs and Windows PCs. | Partial detail |
| Was data accessed? | The code attempted to collect system details. The public account gives no verified device-by-device findings. | Unknown |
| How did it get published? | The route into Cursor’s marketplace under Anthropic’s extension identity has not been publicly explained. | Unknown |
Check the machine and follow up carefully
Cursor said it will contact affected users directly. Its recommended check, as summarized in the source material, is to look for the SSH key label below.
Check for an SSH key labeled svc-telemetry.
If it is present, use Cursor’s cleanup scripts. Uninstalling the extension alone may not remove every reported change.
Consider rebuilding the machine and changing credentials from a different, trusted computer.
Further guidance may clarify whether the build reached your installation and what evidence was found.
What the public statements establish
These statements describe the companies’ accounts and the risk of automatic delivery; they do not provide a confirmed count of successful compromises.
“impacting at most 5,000 users”
Cursor
The Risk of a Trusted Update
The incident shows how a compromised or abused distribution channel can make a malicious update appear to be a routine release. The extension reportedly used the real listing name and identifier, so checking only that an extension is called Claude Code would not have distinguished the altered build from the expected one. Users with automatic extension updates could have received it without taking a separate installation step.
The reported limit of up to 5,000 users is Cursor’s estimate, not a confirmed count of infected devices or successful intrusions. The distinction matters: a machine could have downloaded or run the extension without granting the privileges needed for remote login, while other actions such as collecting system details or adding persistence entries may still have been attempted. The public information does not give a verified count for each outcome.
For organizations, the episode also raises questions about how marketplace publishers are authenticated and how updates are reviewed. Developers often grant editor extensions access to code and local resources as part of normal work. A malicious update distributed through a familiar store can therefore put sensitive development environments at risk even when the official software publisher’s own systems were not compromised.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Version Reached Cursor
Anthropic’s public GitHub release list shows version 2.1.312 as the last official release before the incident, published October 27, and then version 2.1.314 on October 30. The list has no 2.1.313 release. That sequence supports the distinction between Anthropic’s official release and the version found in Cursor’s marketplace; it does not, by itself, explain how the altered package was uploaded.
The affected distribution channel identified in the source material is Cursor’s VS Code extension marketplace. Early reports that named Open VSX were corrected. The source material says researchers found no indication that Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX or the npm package was affected. Anthropic’s technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic systems or employee laptops.
The key unanswered part of the timeline is the route into Cursor’s store. Cursor said it identified the incident and removed the build. Anthropic said a malicious actor “used access to Cursor’s marketplace,” according to the source material. Neither company had publicly explained how the attacker was able to publish using Anthropic’s extension identity when that material was prepared.
““impacting at most 5,000 users””
— Cursor
How the Listing Was Abused
Cursor has not publicly detailed how the altered build entered its marketplace under Anthropic’s extension name and identifier. The source material also does not provide a confirmed count of downloads, machines where the code ran, systems where administrator permissions were granted, or successful remote logins.
Cursor’s estimate of at most 5,000 potentially affected users does not establish how many users received the update or what happened on their devices. Researchers described the code’s intended actions, while Cursor said the SSH step failed on most Macs and Windows PCs. The extent of any data collection or persistence on individual machines remains unclear.
The source material says the attacker’s server was offline, but does not establish when it went offline or whether any information had been accessed before then. Cursor’s direct outreach to potentially affected users may provide more specific guidance, but no user-by-user findings are included in the available account.
Checks for Cursor Users
Cursor users who installed Claude Code through its editor should run the company’s recommended check for an SSH key labeled svc-telemetry. If the key is present, Cursor’s guidance, as summarized in the source material, is to use its cleanup scripts; uninstalling the extension alone may not remove every change described by researchers. Users should consider rebuilding the machine and changing credentials from a different, trusted computer.
Cursor said it will contact affected users. Further updates from Cursor and Anthropic may clarify how the marketplace listing was accessed, how many installations received version 2.1.313 and what evidence the companies found about successful access. Until those details are public, the number of confirmed compromises remains unknown.
Key Questions
Was the official Anthropic Claude Code release compromised?
Anthropic said its systems and employee laptops were not compromised. Its public release list goes from version 2.1.312 to 2.1.314, with no official 2.1.313 entry in the source material.
Who may have received the tampered extension?
Cursor said up to 5,000 users may have been affected by version 2.1.313 in its extension marketplace. That is a maximum estimate; a confirmed number of downloads or compromised machines has not been published in the source material.
What should Cursor users check?
Users with Claude Code installed through Cursor should check for an SSH key labeled svc-telemetry, following Cursor’s guidance. If it is present, the source material says to use Cursor’s cleanup scripts; simply uninstalling the extension may not be sufficient.
Were other Claude Code distribution channels affected?
The source material says researchers found no indication that the versions from Microsoft’s Visual Studio Marketplace, Open VSX or npm were affected. Early reports naming Open VSX were corrected.
Source: Thorsten Meyer AI
