TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cursor says a modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29 and may have reached at most 5,000 users. The code attempted to collect device details and establish persistent remote access; Cursor says the remote-login step failed on most Macs and Windows PCs. The companies have not explained how the build was published under Anthropic’s extension identity.
Cursor says a maliciously modified Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching at most 5,000 users. The version, numbered 2.1.313, was not made by Anthropic, according to Cursor; researchers said it attempted to collect information about affected computers and create a route for remote access. The incident raises questions about how a tampered update appeared under Anthropic’s extension identity in a store used by developers.
According to Cursor, version 2.1.313 appeared in its marketplace at 09:27 UTC on October 29 and was removed at 20:35 UTC, a window of roughly 11 hours. The company said the modified extension was available under the Claude Code listing. The source material identifies the extension ID as anthropic.claude-code, the same identifier associated with the legitimate extension. Users with automatic extension updates enabled could have received it without manually selecting an update.
Security researchers described code that ran when the editor loaded the extension. Their analyses said it gathered details about the computer, added an attacker’s SSH key, attempted to enable remote login, opened a tunnel to an attacker-controlled server and added startup entries intended to persist after a restart. These are researchers’ findings about the code’s behavior; the available statements do not establish how many users’ devices were successfully accessed or what information, if any, was taken from each one.
Cursor said it removed the version, blocked further distribution and shut down its VS Code marketplace while it reviewed the incident. It said it audited access, rotated keys and rebuilt the marketplace before restoring it. Cursor put the possible reach at no more than 5,000 users. Anthropic said its own systems and employee laptops were not compromised. The companies’ statements do not explain how the modified build was published under the extension’s identity.
Security incident · Developer tools
A Look At The Claude Code Update That Reached Up To 5,000 Cursor Users
A modified extension appeared under Anthropic’s Claude Code identity in Cursor’s marketplace. Cursor says the build was available for about 11 hours; the number of successful intrusions remains unknown.
Modified Claude Code extension
Same identity as the legitimate listing
UTC · October 29
Public reports do not establish successful access
What the code attempted
Researchers described actions triggered when the editor loaded the extension. Reported behavior does not establish that every step succeeded on affected machines.
Gather information about the computer.
Researchers identified a key labelled svc-telemetry.
Enable SSH access and open a tunnel to an attacker-controlled server.
Add startup entries intended to persist after restart.
A report could still be placed or sent even if SSH setup failed.
From official release to takedown
The public release sequence places the suspicious build between two Anthropic versions. Anthropic’s release history did not list 2.1.313 at the time described.
2.1.312 published
Anthropic’s preceding public Claude Code release.
2.1.313 appears
Modified build becomes available in Cursor’s marketplace.
Listing removed
Cursor says it blocked further distribution and took the marketplace offline for review.
2.1.314 published
Anthropic’s next public release; 2.1.313 was absent from its release list.
Exposure is not the same as compromise
Cursor’s maximum reach describes possible exposure. Public statements leave key questions about installation, execution and access unanswered.
How many ran it?
Automatic updates may have delivered the build, but the number of users who installed or ran version 2.1.313 has not been specified.
Did anyone gain entry?
Reports do not say how many SSH changes succeeded or whether an attacker accessed any device. The attacker’s server was reported offline.
How did it appear?
Cursor and Anthropic have not publicly explained how the modified build was published under Anthropic’s extension identity.
Why developer machines matter
A developer workstation can contain source code, credentials and access to other systems. A familiar extension name and identifier alone do not verify who produced a specific build.
Delivery could be silent
Users with automatic extension updates enabled may have received the modified version without manually selecting an update.
Credentials deserve care
Credentials used on a potentially affected machine may be at risk. The public information does not say whether data was taken from individual devices.
Identity is not provenance
A known publisher name or extension ID can help identify software, but does not by itself prove that a build came from its expected developer.
If you used Claude Code in Cursor
Cursor’s guidance focuses on checking for the reported key and treating a potentially affected computer cautiously.
- 01Check for an SSH key labelled svc-telemetry.
- 02If found, use Cursor’s cleanup scripts; uninstalling the extension alone may not remove other changes.
- 03Consider rebuilding the machine, following Cursor’s guidance.
- 04Change credentials from a separate, trusted computer.
Up to 5,000 is a ceiling—not a verified incident count.
The estimate indicates the maximum potential reach Cursor reported. The number of installations that ran the code, the number of successful remote logins and any confirmed data theft remain unknown in the available statements.
2.1.313 · CHECK DEVICE · REVIEW ACCESSCursor said it audited access, rotated keys and rebuilt its marketplace before restoring it. Anthropic said its systems and employee laptops were not compromised.
What the companies and researchers said
These statements describe reported impact and scope; they do not resolve the publishing route or the number of successful intrusions.
“impacting at most 5,000 users”
Cursor · potential reach“wasn’t a compromise of Anthropic’s systems or employee laptops.”
Felix Rieseberg · Anthropic technical staff“anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
Jenn Gile · OpenSourceMalware, speaking to The Hacker NewsRisks for Cursor Extension Users
The incident shows how a compromised software distribution channel can put developers at risk even when an extension appears under a familiar name and identifier. Automatic updates may have delivered the modified build, so users did not necessarily need to search for or install a separate look-alike extension. Developers’ machines can contain source code, credentials and access to other systems, making attempted remote access a serious concern even when the available reports do not confirm successful entry.
Cursor said the step that enabled SSH required administrator privileges and failed on most Macs and Windows PCs. That account narrows the reported opportunity for remote login through the tunnel, but it does not mean the extension did nothing: the source material says the SSH key, startup entries and a data report could still be placed or sent. The number of affected installations is not a count of confirmed intrusions. Cursor’s estimate describes potential exposure, while the public information does not specify how many installations ran the code or experienced further access.
For developers, the episode also raises practical questions about trust in extension marketplaces. A publisher name and a known identifier can help users recognize software, but they do not by themselves establish that a particular build came from its expected developer. The immediate concern is checking whether the affected version ran; the broader concern is understanding how marketplace controls allowed it to appear.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Official Release to Takedown
The version at issue sits between legitimate releases in the timeline provided by the source material. Anthropic published Claude Code 2.1.312 on October 27, according to its GitHub release history. Cursor’s marketplace then carried the modified 2.1.313 on October 29. Anthropic released 2.1.314 on October 30; its public release list went from 2.1.312 to 2.1.314, with no 2.1.313 entry at the time the source checked it.
Cursor’s notice says the marketplace listing was removed after detection. The company also said it took the marketplace offline as a precaution, reviewed access, rotated keys and rebuilt the service. Its public account, as represented in the source material, did not provide timings for each response step or describe the mechanism used to publish the modified build.
Some early reports identified Open VSX as the source, but those reports were corrected. The affected distribution channel described by Cursor and the researchers was Cursor’s VS Code extension marketplace. The source material says Claude Code distributed through Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected. Keeping that distinction clear matters because a report about one store does not establish that other versions or distribution channels were compromised.
““impacting at most 5,000 users””
— Cursor
How the Build Reached Cursor
The publishing route remains unexplained. Cursor has not publicly said how the modified build entered its marketplace under Anthropic’s extension identity. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the available information does not detail what access was used, how it was obtained or whether the publisher identity itself was compromised.
Public accounts also do not settle who first detected the incident. Cursor said it identified the issue; The Register credited Phorion with first spotting it; OpenSourceMalware thanked a developer who alerted the group. These accounts may describe different stages of discovery, and the source material does not resolve the sequence.
It is also unclear how many users installed or ran version 2.1.313, how many machines had the attempted SSH change succeed, and whether any attacker gained access to a device. The attacker’s server was reported offline, but that does not establish what activity occurred while it was available. Cursor’s maximum reach estimate should not be read as a verified infection or data-theft figure.
Checks and Incident Follow-Up
Cursor’s recommended immediate step for users who run Claude Code in Cursor is to check for an SSH key labelled svc-telemetry. The source material says that users who find it should not rely on uninstalling the extension alone: Cursor provides cleanup scripts, and the guidance calls for considering a rebuild of the machine. Users should change credentials from a separate, trusted computer, since credentials used on a potentially affected device may be at risk.
Cursor and Anthropic have not provided a public explanation of how the build was published, according to the information available in the source material. Further details about the marketplace investigation, affected installations and any confirmed access would help users understand the incident’s reach. Until then, the reported exposure window and maximum user estimate remain the clearest figures available, while the number of successful compromises is unknown.
Key Questions
Which version of Claude Code was affected?
The modified version was 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public release history went from 2.1.312 to 2.1.314 in the source material’s check.
How many users may have received it?
Cursor said the incident could have affected at most 5,000 users. That is a maximum exposure estimate, not a confirmed count of devices that ran the code or suffered a successful intrusion.
Were other Claude Code distribution channels affected?
The source material says the versions in Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports naming Open VSX were corrected.
What should Cursor users check?
Users with Claude Code in Cursor should check for an SSH key labelled svc-telemetry. If it is present, the guidance says to use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from a different, trusted computer.
Has anyone confirmed that attackers accessed users’ computers?
The source material describes code that attempted to establish remote access, but it does not give a confirmed number of successful intrusions. Cursor said the SSH step failed on most Macs and Windows PCs; the extent of any access remains unclear.
Source: Thorsten Meyer AI
