🔍 Read the full analysis: How To Check Your Cursor Setup After A Tampered Claude Code Update on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cursor says a tampered Claude Code extension, version 2.1.313, was available in its marketplace for about 11 hours on October 29 and may have reached as many as 5,000 users. Users of Claude Code in Cursor should check for an SSH key labeled svc-telemetry; Cursor says affected users should use its cleanup scripts, and may need to rebuild their machine and change credentials from a separate trusted device.
Cursor says a modified Claude Code extension, version 2.1.313, was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The extension used Anthropic’s name and identifier but was not built by Anthropic; Cursor and Anthropic say Anthropic’s systems were not compromised, while the method used to publish the tampered build remains unexplained.
Cursor reported that the extension was available from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It says it removed the version after detecting the incident, blocked further distribution, temporarily shut down its VS Code marketplace, audited access, rotated keys, and rebuilt the marketplace before restoring it. Cursor has put the potential reach at at most 5,000 users; that figure is an upper bound, not a confirmed count of infected machines.
Analyses by security researchers Phorion and OpenSourceMalware describe a loader placed ahead of the extension’s legitimate code. According to those analyses, it ran when the editor loaded the extension and attempted to collect system information, add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server, and persist after restarts. Cursor says enabling SSH required administrator privileges and failed on most Macs and Windows PCs. The attacker’s server is now offline, according to the source material, but that does not establish that every other action failed.
The immediate user check is for an SSH key labeled svc-telemetry, using Cursor’s published checking guidance. Cursor says finding the key calls for its cleanup scripts; uninstalling the extension alone is not enough. The source also advises affected users to consider rebuilding the machine and changing credentials from a separate, trusted computer. These steps are defensive recommendations, not confirmation that every system that received the extension was successfully accessed.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Update Reached Cursor Users
The incident matters because the modified build appeared as an update to the real extension listing, with Anthropic’s actual extension identifier, rather than as an obvious copycat with a misspelled name. Users with automatic updates enabled could have received it without deliberately installing a new extension. The case shows how a compromise of a software distribution channel can put malicious code inside a tool developers already trust.
Code editors and their extensions can access local files, source code, and developer tools when loaded. That makes the reported attempt to establish remote access a serious risk even though Cursor says the administrator-level SSH step failed on most affected computers. Developers should treat a possible exposure as a security incident, check their system, and rotate credentials from a clean device if advised, rather than assuming that removing the extension reverses changes it may have made.
The published information does not establish that the attacker gained access to every system that installed the package, or that source code or credentials were taken. It does establish that the package attempted several actions associated with persistence and remote access, according to the researchers and Cursor’s account. Keeping that distinction clear helps users respond carefully without treating attempted behavior as proof of successful compromise.
Products Worth Considering
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
Which Claude Code Builds Were Affected
The source material identifies the affected package as Anthropic.claude-code version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s preceding official GitHub release was 2.1.312 on October 27; its release list then moved to 2.1.314 on October 30, with no official 2.1.313 entry shown. That version sequence supports the distinction between the tampered Cursor package and Anthropic’s published releases.
Cursor and the researchers said distribution through Microsoft’s Visual Studio Marketplace, Open VSX, and the npm package was not affected. Early reports that named Open VSX as the source were corrected, according to the supplied reporting. Users should therefore distinguish the Cursor marketplace incident from installations obtained through those other channels; the reported affected source is Cursor’s extension marketplace.
Cursor said it took the listing down and later restored its marketplace after security measures that included auditing access and rotating keys. Anthropic technical staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. Those statements address the companies’ systems and distribution channels, but do not settle how the package was published under Anthropic’s identity in Cursor’s marketplace.
“The modified extension was impacting at most 5,000 users.”
— Cursor
How the Package Entered the Store
The central unresolved issue is how the tampered build was published under Anthropic’s extension identity. Cursor has not publicly explained the route used to list or distribute it. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the supplied material does not specify the access method, whether a particular account or system was compromised, or who was responsible.
It is also not clear how many users installed or loaded version 2.1.313, how many machines had the attempted SSH change succeed, or whether any attacker gained access to a user’s computer. Cursor’s estimate is an upper limit on potential exposure, and the server being offline does not by itself establish what data, if any, was collected before it went offline. The public account also does not identify who first detected the incident; sources credit different parties or refer to alerts from developers.
Checks and Investigation Still Ahead
Cursor has told potentially affected users it will contact them directly and has published a check for the svc-telemetry SSH key. Users who had Claude Code installed in Cursor during the incident window should follow Cursor’s current instructions, review whether the affected extension version was present, and use the company’s cleanup guidance if the key is found. If compromise is suspected, changing credentials from a different trusted device and considering a clean rebuild are prudent steps described in the source material.
Further public updates would need to clarify how the listing was altered, how many users actually installed or loaded the package, and what evidence exists of successful access or data collection. Cursor’s marketplace response and Anthropic’s statements address parts of the incident, but the publishing path and user-level impact remain open. Until those details are released, the practical next step for affected Cursor users is to check their systems rather than assume either that the attack succeeded or that uninstalling alone resolved it.
Key Questions
What was the tampered Claude Code update?
It was version 2.1.313 of the Claude Code extension in Cursor’s VS Code marketplace. Cursor says it was not built by Anthropic and was available for about 11 hours on October 29, 2026.
How can I check whether my Cursor setup was affected?
Use Cursor’s published check to look for an SSH key labeled svc-telemetry. Review Cursor’s current incident guidance as well, particularly if Claude Code was installed in Cursor during the marketplace exposure window.
Is uninstalling the extension enough?
According to the supplied guidance, uninstalling alone is not enough if the key is present. Cursor directs affected users to its cleanup scripts; users may also need to consider rebuilding the machine and changing credentials from a separate trusted computer.
Were all Claude Code distribution channels affected?
No. Cursor and the researchers said the reported incident affected Cursor’s marketplace, not Microsoft’s Visual Studio Marketplace, Open VSX, or the npm package. Early reports naming Open VSX were corrected.
Do we know whether attackers accessed user computers?
That has not been established in the supplied reporting. The extension attempted several actions, but Cursor said the administrator-level SSH step failed on most Macs and Windows PCs. The number of successful installations or intrusions remains unknown.
Source: ThorstenMeyerAI.com
