🔍 Read the full analysis: Check These Details After The Tampered Claude Code Update on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cursor says a tampered Claude Code extension, version 2.1.313, was available in its marketplace for about 11 hours on October 29, 2026, and may have reached up to 5,000 users. The code attempted to collect system information, install an SSH key and establish remote access; Cursor says the SSH step failed on most Macs and Windows PCs. Cursor users should check for the key labelled svc-telemetry and follow the vendor’s cleanup guidance if it is present.
Cursor says a modified Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The build carried version number 2.1.313 and Anthropic’s extension identity, but Cursor and Anthropic say it was not an official Anthropic release. Its code attempted to establish persistent access to affected computers, making the incident a software supply-chain risk for Cursor users.
Cursor places the exposure window at 09:27 to 20:35 UTC on October 29. The company says it removed the version after detection, blocked further distribution and temporarily shut down its VS Code marketplace as a precaution. Cursor says it audited access, rotated marketplace keys, rebuilt the marketplace and later restored it. It has not published timings for each response step.
Security analyses by Phorion and OpenSourceMalware, as described in the supplied reporting, found a loader placed before the extension’s legitimate code. It ran when the extension loaded, without requiring a user to click or open Claude Code. The reported actions included collecting information about the computer, adding an attacker-controlled SSH public key, enabling remote login, opening a tunnel to an attacker server and setting up ways to persist after restarts.
Cursor says the SSH-enabling step required administrator privileges and failed on most Macs and Windows PCs. That limits what the attacker could do through that route, but does not establish that every other action failed. The supplied material says the key, startup entries and a data report were still created; it also says the attacker’s server is now offline. Cursor advises users to check for a key labelled svc-telemetry. If found, removing the extension alone is not sufficient: users should use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why an Extension Update Matters
The incident matters because the compromised version appeared as an update to the real Claude Code listing, with its expected name and extension identifier, rather than as an obvious copycat. Users with automatic extension updates could have received it without taking a separate action. This illustrates how trust in a distribution channel can be abused: a familiar listing does not by itself prove that a particular build came from its named developer.
For developers, the potential exposure includes local files, source code and development tools, which an editor extension can access when it runs. The reported attempt to add an SSH key and preserve access raises the stakes beyond a mistaken download, even though Cursor says the remote-login step generally failed on Macs and Windows PCs. Users should treat the vendor’s checks and cleanup instructions as relevant even if the attacker server is offline; that status does not, on its own, establish that a computer was untouched.
The stated figure of at most 5,000 users is Cursor’s estimate of potential impact, not a confirmed count of infected machines or successful remote logins. That distinction matters when judging the scale: the available information describes who could have received the update, not how many devices were compromised or what data, if any, was taken from them.
Products Worth Considering
Apple Mac mini Desktop Computer with M4 chip, 10‑core CPU and GPU, 24GB Unified Memory, 512GB SSD, Gigabit Ethernet
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Dell XPS 13 9350 Copilot+ Laptop, 13.4-inch 120Hz Display, Intel Core Ultra 7 256V, 16GB RAM, 512GB SSD, Ubuntu Linux 24.04 LTS
As an affiliate, we earn on qualifying purchases.
Which Claude Code Builds Were Affected
The supplied account says Anthropic’s last official release before the incident was Claude Code 2.1.312, published on GitHub on October 27. The tampered 2.1.313 appeared in Cursor’s marketplace on October 29. On October 30, Anthropic published version 2.1.314; the public release list went from 2.1.312 to 2.1.314, with no official 2.1.313 entry reported.
The affected distribution channel is a key part of the story. According to the supplied material, the compromised build came from Cursor’s VS Code extension marketplace. Early reports that named Open VSX were corrected. The material says Claude Code obtained through Microsoft’s Visual Studio Marketplace, Open VSX and the npm package was not affected by this incident. Those distinctions should not be read as a general guarantee about other software or future releases.
Cursor and Anthropic have both addressed the incident. Anthropic said its own systems and employee laptops were not compromised, while attributing the event to an actor who used access to Cursor’s marketplace. The companies’ statements separate an attack on the marketplace distribution route from a breach of Anthropic’s systems, but the public account supplied here does not explain how the modified extension was published under Anthropic’s identity.
“The modified extension was impacting at most 5,000 users.”
— Cursor
How the Fake Build Reached Cursor
The central unresolved issue is how the modified build was published under Anthropic’s extension name and identifier. Cursor has not explained the path that allowed this, according to the supplied account. Anthropic said an actor used access to Cursor’s marketplace, but that statement does not detail how the access was obtained, what permissions were involved or whether the listing’s publication controls were bypassed.
The public information also does not establish how many users installed the version, how many machines retained the added key or startup entries, or whether any data was accessed or misused. Cursor’s estimate of up to 5,000 potentially affected users is not an infection count. The SSH step reportedly failed on most Macs and Windows PCs, but the material does not quantify those failures or provide a complete device-by-device account of the other actions.
Some accounts differ about who first detected the incident. The supplied reporting says Cursor claimed it identified the issue, The Register credited Phorion with first spotting it, and OpenSourceMalware thanked a developer who alerted the group. The public record described there does not settle the sequence.
Checks and Vendor Follow-Up
Cursor users who installed or updated Claude Code through its marketplace during the exposure window should run Cursor’s check for the svc-telemetry SSH key and follow the company’s cleanup instructions if it appears. The supplied guidance says uninstalling the extension is not enough. Users should consider Cursor’s cleanup scripts, assess whether rebuilding the machine is warranted and change credentials using a different, trusted device. Anyone investigating should avoid relying solely on the extension’s current installed version to determine whether the earlier build ran.
Cursor has said it will contact affected users directly, according to the supplied material. The next useful updates would clarify the distribution path, the number of users who actually received the build, and whether the company found evidence of successful remote access or data theft. Anthropic and Cursor have not provided those details in the source material supplied for this report.
Users who obtained Claude Code through other channels should verify which package and source they used rather than assume every installation was involved. The supplied account identifies Microsoft’s Visual Studio Marketplace, Open VSX and npm as unaffected by this specific incident; it identifies Cursor’s marketplace as the distribution route under investigation.
Key Questions
Which Claude Code version was tampered with?
The affected build was version 2.1.313 in Cursor’s VS Code extension marketplace. The supplied account says Anthropic did not publish an official 2.1.313 release.
How can Cursor users check for signs of the attack?
Run Cursor’s check for an SSH key labelled svc-telemetry. If it is present, the supplied guidance says not to rely on uninstalling the extension alone; use Cursor’s cleanup scripts and consider further device and credential precautions.
Does the incident mean Anthropic’s systems were breached?
No breach of Anthropic’s systems or employee laptops was reported by the company. Anthropic said the incident involved access to Cursor’s marketplace, though the route used to publish the build has not been explained in the supplied material.
Were all Claude Code installations affected?
No. The reported exposure was limited to the modified extension distributed through Cursor’s marketplace. The supplied account says the Microsoft Visual Studio Marketplace, Open VSX and npm packages were not affected by this incident.
Does Cursor’s 5,000-user figure mean 5,000 computers were compromised?
No. Cursor’s figure is an estimate of at most 5,000 potentially affected users. It is not a confirmed count of infected machines, successful logins or users whose data was taken.
Source: ThorstenMeyerAI.com
