🔍 Read the full analysis: Claude Code Update Reached Up To 5,000 Cursor Users: What We Know on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A modified Claude Code extension, version 2.1.313, was available in Cursor’s extension marketplace for about 11 hours on October 29, Cursor says. The build ran when loaded and attempted to collect system details and establish remote access; Cursor estimates up to 5,000 users may have been affected. The companies have not explained how it was published under Anthropic’s extension identity.
Cursor says a tampered version of Anthropic’s Claude Code extension was available in its extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The package used the official extension name and identifier, but Cursor says it was not built by Anthropic; its code attempted to gather information about users’ computers and create a way for an attacker to connect remotely.
According to Cursor, the modified version 2.1.313 was available from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29. Cursor says it removed the version after detecting the issue, blocked further distribution and temporarily shut down its VS Code extension marketplace while it audited access, rotated keys and rebuilt the marketplace. It has not published the timing for each of those actions.
Security analyses cited in the source account describe a small loader placed ahead of the extension’s legitimate code. It ran when the editor loaded the extension, so a user did not need to open Claude Code or click a prompt. The code attempted to collect computer details, add an attacker-controlled SSH key, enable remote login and open a tunnel to a server. Researchers also reported mechanisms intended to keep the access in place after a restart.
Cursor says enabling SSH required administrator privileges and that this step failed on most Macs and Windows computers. That limited the attacker’s ability to log in through the tunnel on those machines, according to Cursor; the attacker’s server is now offline, according to the source material. Those points do not establish that the other actions failed: the key, startup entries and data report may still have been created. Cursor says it will contact affected users directly.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why Extension Delivery Matters
The incident shows how a familiar distribution channel can carry a harmful update under a trusted extension identity. Because the package appeared as an update to the real Claude Code listing, users with automatic updates enabled could have received it without installing a look-alike extension or taking a separate action.
For developers, the potential exposure is meaningful because editor extensions can access local files, source code and development tools available to the user. Cursor’s estimate of up to 5,000 potentially affected users is a maximum, not a confirmed count of machines where the malicious code ran or where remote access succeeded. The available information does not establish that any particular source code or credentials were taken.
The incident also leaves a marketplace security question for Cursor: how a package was published under Anthropic’s name and identifier. Until the companies explain that path, users cannot tell from the public account whether the failure involved an account, a publishing process, or another route. That distinction matters for understanding whether safeguards have addressed the cause, rather than only removing this version.
Popular right now
De'Longhi Magnifica Evo Fully Automatic Espresso Machine with Manual Milk Frother, Silver
Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black
KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)
As an affiliate, we earn on qualifying purchases.
Timeline and Affected Channels
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 release listed, according to the source’s check of the release page on October 30. The modified 2.1.313 was distributed through Cursor’s VS Code extension marketplace, not as an official Anthropic release.
Cursor says the affected package was its marketplace listing for the extension. Anthropic says its own systems were not compromised, and its technical staff said employee laptops were not involved. The source material also says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected; early reports that named Open VSX were corrected.
Cursor’s public estimate was posted on October 30, alongside reports and analyses from security firms Phorion and OpenSourceMalware. The public record does not identify consistently who first detected the tampering: Cursor said it identified the incident, while accounts credited researchers and a developer who alerted them. Those reports describe separate claims about discovery, not a settled timeline.
“The modified extension was “impacting at most 5,000 users.””
— Cursor
What the Public Record Cannot Confirm
Neither Cursor nor Anthropic has publicly explained how the modified build entered Cursor’s marketplace under Anthropic’s extension identity. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available material does not describe the access path or show whether an account or publishing control was compromised.
The affected-user figure is an estimate, and the sources do not give a verified count of installations, successful SSH changes, or systems accessed by an attacker. It is also not clear whether any files, source code, credentials or other data were taken. Cursor’s statement that SSH activation failed on most Macs and Windows PCs does not rule out other exposure or establish what occurred on individual machines.
Checks for Cursor Users
Cursor says it will contact affected users. People who installed or updated Claude Code through Cursor during the exposure window should check Cursor’s guidance for a key labelled svc-telemetry. The source material warns that uninstalling the extension alone may not remove changes made by the malicious code; users who find the key are advised to use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a separate, trusted computer.
Cursor and Anthropic have not provided a public explanation of the marketplace publishing route in the material available here. Further updates would need to clarify how the package was accepted, what investigation found about access and whether the companies can determine which installations actually ran the modified code.
Key Questions
What happened to the Claude Code extension in Cursor?
Cursor says a modified version 2.1.313 of the Claude Code extension was available in its marketplace for about 11 hours on October 29. Cursor says the build was not made by Anthropic and removed it after detection.
How many users may have received the extension?
Cursor estimated that the incident could have affected at most 5,000 users. That is an upper-bound estimate, not a confirmed count of users whose machines were compromised.
What did the modified code try to do?
Security analyses describe code that ran when the extension loaded and attempted to collect computer details, add an attacker’s SSH key, enable remote login and open a tunnel to an external server. Cursor says the SSH step failed on most Macs and Windows PCs because it required administrator privileges.
Was Anthropic’s own system breached?
Anthropic said its systems and employee laptops were not compromised. The public information does not explain how the modified package was published in Cursor’s marketplace under Anthropic’s extension identity.
What should a potentially affected user do?
Check Cursor’s instructions for a key labelled svc-telemetry. If present, the source material says uninstalling alone is not enough: use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a different, trusted computer.
Source: ThorstenMeyerAI.com
