TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A modified version of Anthropic’s Claude Code extension was distributed through Cursor’s extension marketplace for about 11 hours on October 29, according to Cursor and security researchers. Cursor says up to 5,000 users may have been affected; the code attempted to collect device information and establish remote access. The companies have not publicly explained how it was published under Anthropic’s extension identity.
A tampered Claude Code extension was available through Cursor’s VS Code extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users, Cursor says. Security researchers reported that version 2.1.313 attempted to collect information about affected computers and create a route for remote access; Cursor says it removed the build and contacted affected users.
The affected listing used the name and identifier associated with Anthropic’s Claude Code extension, according to researchers cited by The Hacker News. The modified version was not built by Anthropic. Because it was distributed as an update to the existing listing, users with automatic extension updates could have received it without manually installing a new extension. OpenSourceMalware co-founder Jenn Gile told The Hacker News that users with auto-update enabled could have consumed the malware.
Analyses by security researchers describe code that ran when the editor loaded the extension. It gathered details about the computer, attempted to add an SSH key associated with the attacker, enable remote login, open a tunnel to an external server and persist across restarts. Cursor said the step that enabled SSH required administrator privileges and failed on most Macs and Windows computers. That limited one route to access, but does not establish that every other action failed or that no information was collected.
Cursor said it removed version 2.1.313 after detecting the issue, blocked further distribution and temporarily shut down its VS Code marketplace while it reviewed access, rotated keys and rebuilt the marketplace. Anthropic said its systems were not compromised and its official distribution channels were unaffected. Anthropic’s public GitHub release history goes from version 2.1.312 to 2.1.314, with no 2.1.313 release listed as of October 30.
The Name Was Right.
The Code Wasn’t.
A tampered Claude Code update reached Cursor’s extension marketplace for about 11 hours on October 29. Cursor says it may have reached up to 5,000 users. Here is what is known—and what Cursor users should check.
A trusted name carried a tampered build
The listing used the name and identifier associated with Anthropic’s Claude Code extension, according to researchers cited by The Hacker News. The modified build was not made by Anthropic. Because it appeared as an update to the existing listing, users with automatic updates enabled may have received it without choosing a new extension.
Information gathering
Researchers said the code attempted to collect details about affected computers. Available accounts do not establish whether collection succeeded on any particular machine.
Remote access route
Analyses describe an attempt to add an attacker-associated SSH key, enable remote login, and open a tunnel to an external server.
One step often failed
Cursor said enabling SSH required administrator privileges and failed on most Macs and Windows computers. That does not show that every other action failed.
Release and response timeline
Times below are UTC where specified. Cursor has not published exact times for its marketplace review, key rotation, or rebuild.
Anthropic’s preceding Claude Code release appeared on GitHub.
Cursor says the modified build was available for about 11 hours, then removed.
Cursor said it blocked further distribution, audited access, rotated keys, and rebuilt the marketplace.
Anthropic’s next public GitHub release followed. No 2.1.313 release is listed there as of October 30.
What is known—and what remains unanswered
Cursor and researchers described the exposure and attempted activity. Public information does not yet establish the number of successful intrusions or the extent of any data loss.
Listing removed
Cursor says it removed version 2.1.313 after detection and contacted affected users. Anthropic says its systems and official distribution channels were not compromised.
How it was published
The companies have not publicly explained how the modified build was submitted under Anthropic’s extension identity or how marketplace access was obtained.
Successful access
It is unclear how many users installed or ran the build, whether data reached the external server, or whether an attacker gained remote access.
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
“It wasn’t a compromise of Anthropic’s systems or employee laptops.”
Cursor said it removed the version “immediately upon detection.”
Check the machine, then follow current guidance
If you used Claude Code inside Cursor during the October 29 exposure window, follow Cursor’s current security notice. An extension uninstall alone may not remove changes the reported code attempted to make.
Practical checks
- Check for an SSH key labelled svc-telemetry.
- If present, use Cursor’s cleanup guidance and scripts; do not rely on uninstalling the extension alone.
- Watch for direct instructions from Cursor and Anthropic, including updated cleanup steps.
- If you suspect compromise, consider a clean rebuild and change credentials from a separate, trusted computer.
How a familiar update can become a risk
The incident shows why an expected extension name or identifier cannot by itself verify every new build.
Quick answers
What happened?
A modified version numbered 2.1.313 was available through Cursor’s VS Code extension marketplace for about 11 hours on October 29, according to Cursor.
How many users were affected?
Cursor said the listing may have reached up to 5,000 users. That is potential reach, not a confirmed compromise count.
What should users check?
Follow Cursor’s guidance and check for an SSH key labelled svc-telemetry. If found, use its cleanup instructions.
Were Anthropic’s systems affected?
Anthropic said its systems were not compromised and its official distribution channels were unaffected. The identified listing was in Cursor’s marketplace.
Risks of a Trusted Extension Update
The incident shows how a compromised distribution route can put users at risk even when an extension has the expected name and identifier. Users may rely on those details, or automatic updates, without checking every new build. In this case, the reported code attempted several steps to gain persistence or remote access, so removing the extension alone may not address all changes it made.
The reported reach is also limited by what has been confirmed: Cursor’s figure is up to 5,000 potentially affected users, not a count of machines on which the code succeeded or accounts that were accessed. The companies’ statements and researchers’ findings describe exposure and attempted activity; they do not establish the number of successful intrusions or the extent of any resulting data loss.
For people who used Claude Code inside Cursor during the exposure window, the practical concern is whether the affected version ran and left behind an SSH key, startup entries or other changes. Cursor has directed users to check for a key labelled svc-telemetry and use its cleanup guidance if they find it.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
The October 29 Release Timeline
Anthropic published Claude Code version 2.1.312 on GitHub on October 27 at 20:24 UTC, according to the release history cited in the source material. Cursor says the modified 2.1.313 build became available in its marketplace on October 29 at about 09:27 UTC and remained there until about 20:35 UTC. The stated times correspond to 2:27 a.m. and 1:35 p.m. Pacific time.
After taking the build down, Cursor said it audited marketplace access, rotated keys and rebuilt the marketplace before bringing it back online. The company has not published the times for those actions in the material available here. Anthropic released version 2.1.314 on GitHub at 01:06 UTC on October 30. Later that day, Cursor described the potential reach as at most 5,000 users, and Anthropic staff member Felix Rieseberg said the event was not a compromise of Anthropic’s systems or employee laptops.
Some early reports identified Open VSX as the distribution source, but those reports were corrected, according to the source material. Cursor’s marketplace is the store identified in the later accounts. Researchers and the vendors said the Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected.
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
— Jenn Gile, co-founder of OpenSourceMalware, speaking to The Hacker News
How the Build Reached Cursor
The central unanswered question is how someone published a modified build under Anthropic’s extension identity. Cursor has not publicly explained the route used to submit or authorize it. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available material does not establish how that access was obtained or whether any specific credentials or systems were compromised.
It is also unclear how many users actually installed or ran version 2.1.313, whether the attempted data collection succeeded on particular machines, or whether any attacker gained remote access. Cursor’s “at most 5,000” figure describes potential reach, not confirmed infections. The attacker’s server is reported to be offline, but that alone does not show what data, if any, was received before it went offline.
Checks for Cursor Users
Users who ran Claude Code inside Cursor during the October 29 exposure window should follow Cursor’s current security notice and check for an SSH key labelled svc-telemetry. Cursor’s guidance says uninstalling the extension is not enough if the key or related changes are present; affected users should use the company’s cleanup scripts. The source material also advises considering a clean rebuild and changing credentials from a separate, trusted computer when compromise is suspected.
Cursor says it will contact affected users directly. Users should look for further instructions from Cursor and Anthropic, including any updated cleanup steps. The next public information that could clarify the incident would be a detailed account of how the marketplace listing was altered, how many users installed or ran it, and what evidence exists about successful access or data transfer.
Key Questions
What happened to the Claude Code extension in Cursor?
A modified version, numbered 2.1.313, was available through Cursor’s VS Code extension marketplace for about 11 hours on October 29, according to Cursor. Researchers said it used the name and identifier of Anthropic’s Claude Code extension.
How many users were affected?
Cursor said the modified listing may have reached up to 5,000 users. That is a maximum potential reach, not a confirmed count of users whose machines were compromised.
What should Cursor users check?
Users who had Claude Code in Cursor during the exposure window should follow Cursor’s security guidance and check for an SSH key labelled svc-telemetry. If it is present, Cursor says removal of the extension alone is insufficient; users should follow its cleanup instructions.
Were Anthropic’s systems or other Claude Code channels affected?
Anthropic said its own systems were not compromised. Cursor and researchers reported that the Microsoft Visual Studio Marketplace, Open VSX and the npm package were not affected. The tampered build was reported in Cursor’s marketplace.
How did the modified version get into Cursor’s marketplace?
The public material does not explain how the build was published under Anthropic’s extension identity. Cursor has not detailed the entry route; Anthropic said a malicious actor used access to Cursor’s marketplace.
Source: Thorsten Meyer AI
