TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cursor says a modified Claude Code extension, version 2.1.313, was available in its marketplace for about 11 hours on October 29, 2026, and may have reached at most 5,000 users. Cursor advises affected users to check for an SSH key labelled svc-telemetry; removing the extension alone may not undo changes it made.
Cursor says a modified version of Anthropic’s Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching at most 5,000 users. The build used the official extension’s name and identifier, but Cursor says Anthropic did not create it; users who installed or updated it should check their machines for signs of persistence.
Cursor’s security notice places the availability window at 09:27 to 20:35 UTC on October 29 (2:27 a.m. to 1:35 p.m. Pacific time). The affected release was labelled 2.1.313 and appeared under the identifier anthropic.claude-code. Cursor says it removed the version after detection, blocked further distribution and temporarily shut down its VS Code marketplace while it reviewed and rebuilt the service.
Analyses by security researchers describe code that ran when the editor loaded the extension. It attempted to collect information about the computer, add an SSH key labelled svc-telemetry, enable remote login and create a tunnel to an attacker-controlled server, with mechanisms intended to persist across restarts. Cursor says enabling SSH required administrator privileges and that this step failed on most Macs and Windows computers. That does not establish that all other attempted actions failed.
Cursor says it will contact potentially affected users directly. The guidance in the source material is to check for the svc-telemetry key. If it is present, uninstalling the extension may not be enough: Cursor’s cleanup scripts, rebuilding the machine and changing credentials from a separate trusted computer are advised. The attacker’s server is reported offline, but that does not by itself confirm that every affected machine has been cleaned.
Security brief · Cursor marketplace incident
How to Check for the Tampered Claude Code Update in Cursor
A modified build labelled 2.1.313 appeared in Cursor’s VS Code extension marketplace for about 11 hours on October 29, 2026. Here’s what is known, what remains unclear, and how to check your device.
Look for an SSH key labelled svc-telemetry.
If it is present, removing the extension alone may not undo changes made to the machine. Follow Cursor’s cleanup guidance01 / What happened
A trusted store delivered a modified build
The altered code appeared as an update to the familiar extension listing. A known name and identifier do not establish that a specific build came from its stated publisher.
Cursor’s extension marketplace
Cursor says the modified version was available from 09:27 to 20:35 UTC. It removed the version, blocked further distribution, and temporarily shut down its marketplace for review and rebuilding.
Official name, altered code
The build used Anthropic’s extension name and identifier, but Cursor says Anthropic did not create it. Anthropic said a malicious actor used access to Cursor’s marketplace.
Other channels unaffected
Reports say Microsoft’s Visual Studio Marketplace, Open VSX, and the npm package were not affected. Anthropic said its official channels were unaffected.
02 / Reported behavior
What the extension reportedly attempted
Security researchers described code that ran when the editor loaded the extension. The success of each attempted action on individual devices is not confirmed.
Collect device information
Researchers described an attempt to gather information about the computer.
Add an SSH key
Check for the key label svc-telemetry.
Enable remote login
Cursor says this required administrator privileges and failed on most Macs and Windows computers.
Create persistence
The reported behavior included an attacker-controlled tunnel and mechanisms intended to survive restarts.
03 / What is known
Upper bound is not a confirmed impact count
Cursor’s “at most 5,000” figure describes potential reach. Downloads, successful installations, and machines where malicious actions succeeded have not been confirmed in the supplied material.
“impacting at most 5,000 users”Cursor
“wasn’t a compromise of Anthropic’s systems or employee laptops.”Felix Rieseberg · Anthropic technical staff
“anyone who has their Claude Code instance set to auto-update could have consumed the malware.”Jenn Gile · OpenSourceMalware, via The Hacker News
04 / Response guide
Check devices and act on findings
People who used Claude Code through Cursor during the exposure window should review Cursor’s incident guidance and watch for direct notices.
| Finding | What it means | Suggested response |
|---|---|---|
| Key labelled svc-telemetry is present | Possible persistence indicator | Follow Cursor’s cleanup instructions. Consider rebuilding the machine and changing credentials from another trusted device. |
| Extension was installed or updated during the window | Potential exposure; outcome unknown | Check the device and review Cursor’s incident guidance. Cursor says it will contact potentially affected users. |
| Extension was removed | Removal alone may not reverse system changes | Check for the key and follow cleanup guidance if it is found. |
| Used another reported channel | Reported unaffected | Supplied reports say Microsoft Visual Studio Marketplace, Open VSX, and npm were not affected. |
05 / Key questions
Quick answers
The exact listing access method, attacker identity, and number of successful compromises remain unclear.
Which version was affected?
Modified build 2.1.313, listed as anthropic.claude-code in Cursor’s VS Code extension marketplace.
When was it available?
October 29, 2026, from 09:27 to 20:35 UTC—about 11 hours.
Does 5,000 mean that many computers were compromised?
No. It is Cursor’s upper bound for potentially affected users, not a confirmed count of compromised machines.
Was Anthropic’s system compromised?
Anthropic technical staff said the incident was not a compromise of Anthropic’s systems or employee laptops.
A Trusted Store Delivered the Build
The incident matters because the modified code appeared as an update to the real extension listing, not simply as a separate extension with a similar name. Users who had automatic updates enabled may have received it without deliberately installing a new product, according to researcher Jenn Gile, quoted by The Hacker News.
That makes the distribution channel central to the risk: an extension’s familiar name and identifier do not prove that a particular build came from its stated publisher. The reported attempts to create remote access and persist on a computer could affect more than the editor itself if the steps succeeded. Cursor’s estimate is a ceiling of 5,000 potentially affected users, not a confirmed count of compromised machines.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Jackery Explorer 1000 v2 Portable Power Station
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
As an affiliate, we earn on qualifying purchases.
Release Numbers and Store Scope
Anthropic’s public GitHub release list shows version 2.1.312 on October 27, followed by 2.1.314 on October 30; it contains no 2.1.313 entry, according to the supplied source material’s check on October 30. The gap is consistent with the claim that the Cursor build was not an official Anthropic release, though the release list alone does not explain how the altered version entered Cursor’s marketplace.
The source material says the affected distribution was Cursor’s VS Code extension marketplace. It reports that Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected; early reports naming Open VSX were corrected. The distinction matters because users may install Claude Code through different channels. Anthropic also said its official channels were not affected.
““impacting at most 5,000 users””
— Cursor
How the Listing Was Altered
Cursor has not publicly explained how the modified build was published under Anthropic’s extension identity. Anthropic said a malicious actor used access to Cursor’s marketplace, but the source material provides no account of the access method, who held it or how the listing’s publisher identity was used.
The exact number of downloads, installations and machines where any attempted action succeeded remains unclear. Cursor’s “at most 5,000” figure is an upper bound. The public record described in the source also differs on who first detected the incident: Cursor says it identified it, while The Register credited Phorion and OpenSourceMalware acknowledged a developer alert. The attacker’s identity and motive have not been established in the supplied material.
Check Devices and Await Notices
Cursor says it will contact potentially affected users. People who used Claude Code through Cursor during the exposure window should review Cursor’s incident guidance and check for the svc-telemetry SSH key. If it appears, they should follow Cursor’s cleanup instructions; the supplied guidance also recommends considering a machine rebuild and changing credentials from another trusted device.
Further clarity depends on Cursor explaining how the listing was altered and reporting what its review found. Users should also distinguish the Cursor marketplace build from other Claude Code distribution channels, which the supplied reports say were not affected. The available statements do not establish whether additional findings or remediation updates will be published.
Key Questions
Which Claude Code version was affected?
The modified build was labelled 2.1.313 and appeared in Cursor’s VS Code extension marketplace under anthropic.claude-code.
When was it available?
Cursor says it was available from 09:27 to 20:35 UTC on October 29, 2026, about 11 hours.
How can I check for a sign of compromise?
Check for an SSH key labelled svc-telemetry, following Cursor’s incident guidance. The source material says that if the key is present, uninstalling the extension alone is not enough.
Were other Claude Code distribution channels affected?
The supplied reports say the Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected. Cursor’s marketplace was the reported source of the modified build.
Does Cursor’s 5,000 figure mean that many computers were compromised?
No. Cursor described at most 5,000 users as potentially affected. The number of successful installations or machines where malicious actions succeeded has not been confirmed in the supplied material.
Source: Thorsten Meyer AI
