🔍 Read the full analysis: The Wrong Code Behind The Right Claude Code Name: What To Check on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cursor says a modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29, 2026, and may have reached up to 5,000 users. Cursor recommends checking for an SSH key labelled svc-telemetry; users who find it should use the company’s cleanup guidance and change credentials from a trusted device.
Cursor says a tampered Claude Code extension, version 2.1.313, was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The build used Anthropic’s extension name and identifier but was not developed by Anthropic, and Cursor advises users to check for an unauthorized SSH key labelled svc-telemetry—a reminder of the risks discussed in Claude Code security coverage.
According to Cursor, the modified extension was listed from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29. The company said it removed the version after detecting the incident, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor said it audited access, rotated keys, rebuilt the marketplace and brought it back online. It has not publicly detailed the timing of each response step.
Security researchers described a small malicious loader placed before the extension’s legitimate code. It ran when the editor loaded the extension, without requiring a user to open Claude Code or click a prompt. The reported actions included collecting information about the computer, adding an attacker-controlled SSH public key, trying to enable remote login, opening a tunnel to an attacker’s server and setting up persistence across restarts.
Cursor said enabling SSH required administrator privileges and that this step failed on most Macs and Windows computers. The company also said the attacker’s server is now offline. Those statements do not establish that every attempted action failed: researchers reported that the key, startup entries and a system-information report could still be written. Cursor says it will contact affected users directly.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
Why the Extension Identity Matters
The incident shows the risk when a developer tool installs an update from a marketplace under a familiar publisher name. Because the malicious build appeared as an update to the existing Claude Code listing, users with automatic extension updates could have received it without deliberately searching for or installing a look-alike add-on. The familiar name and identifier were not proof that this particular package had been built by Anthropic.
Code editors can grant extensions access to local files, source code and other developer tools. That can make a compromised extension a route to sensitive project material or account credentials, even if a particular remote-access step fails. Cursor’s stated impact estimate is at most 5,000 users; it has not published a confirmed count of installations or successful compromises.
Products Worth Considering
Logitech MX Keys S Wireless Keyboard, Graphite
Jackery Explorer 1000 v2 Portable Power Station
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
The Release and Removal Timeline
Anthropic’s public release history went from Claude Code 2.1.312 to 2.1.314, with no 2.1.313 release listed, according to the source material’s check of the release page on October 30. The modified 2.1.313 package appeared in Cursor’s marketplace during that gap. Anthropic released 2.1.314 on October 30, after the marketplace incident.
Cursor’s account places the exposure window at roughly 11 hours on October 29. The source material says early reports that named Open VSX were corrected. Cursor and the researchers cited in the report said the affected distribution channel was Cursor’s marketplace; the Claude Code extension from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were reported as unaffected.
Cursor’s notice said it removed the package and took marketplace-wide precautions. Anthropic’s technical staff member Felix Rieseberg later said the incident was not a compromise of Anthropic’s systems or employee laptops. The public accounts do not identify who first detected the tampering: Cursor says it identified the incident, while reporting and research groups have described other discovery leads.
“The modified extension impacted at most 5,000 users.”
— Cursor
What the Public Record Does Not Show
The companies have not explained how the altered build was published under Anthropic’s extension identity. Anthropic said a malicious actor used access to Cursor’s marketplace, but Cursor has not publicly described the publishing path or identified the actor. It is also unclear how many users installed or ran the package, whether any systems were successfully accessed, or what data, if any, was taken beyond the reported system-information collection.
Cursor’s estimate of up to 5,000 potentially affected users is not a confirmed installation or compromise count. The reported failure of the SSH-enabling step on most Macs and Windows PCs does not establish that the other actions failed on those machines. The source material also does not provide a complete public accounting of the incident investigation or independent confirmation of the attacker’s server status.
Checks for Cursor Users
Cursor users who installed or updated Claude Code through its marketplace during the exposure window should run Cursor’s recommended check for an SSH key labelled svc-telemetry. A matching key is a warning sign, but users should follow Cursor’s official incident guidance rather than assume that uninstalling the extension alone removes changes already made to the system.
Cursor recommends using its cleanup scripts if the key is present; its guidance also says users should consider rebuilding the machine and change credentials from a separate, trusted computer. Users should watch for direct communication from Cursor and follow the company’s updates. Further reporting will depend on what Cursor discloses about the marketplace publishing route, the final number of affected installations and the results of its investigation.
Key Questions
What was the affected Claude Code version?
The affected package was version 2.1.313, a modified build listed in Cursor’s VS Code extension marketplace on October 29, 2026. Cursor said it was not developed by Anthropic.
How can I check whether my Cursor installation may be affected?
Follow Cursor’s incident guidance and check for an unauthorized SSH key labelled svc-telemetry. Cursor says users who find it should use the company’s cleanup scripts; removing the extension by itself may not undo changes already made.
Does finding the key prove an attacker accessed my computer?
No. The reported key is an indicator to investigate, not proof that remote access succeeded or that data was taken. Cursor said the SSH-enabling step failed on most Macs and Windows PCs, but the full number of successful compromises has not been disclosed.
Were Claude Code users on other distribution channels affected?
The source material reports that Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were unaffected. Cursor’s marketplace was identified as the affected channel; early reports naming Open VSX were corrected.
Why is the cause still unknown?
Cursor has not explained how the malicious build was published under Anthropic’s extension identity. Anthropic said its own systems were not compromised, but the route used to place the altered package in Cursor’s marketplace remains undisclosed.
Source: ThorstenMeyerAI.com
