Did The Tampered Claude Code Update Reach Your Cursor Setup?

🔍 Read the full analysis: Did The Tampered Claude Code Update Reach Your Cursor Setup? on ThorstenMeyerAI.com

Cursor says a tampered version of Anthropic’s Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially affecting up to 5,000 users. The modified version, numbered 2.1.313, used the extension’s legitimate name and identifier but was not built by Anthropic; Cursor says it removed the release and is contacting potentially affected users.

According to Cursor’s security notice, the modified extension was available from 2:27 a.m. to 1:35 p.m. Pacific time (09:27 to 20:35 UTC) on October 29. Cursor said it removed the version after detecting it, blocked further distribution, and temporarily shut down its VS Code extension marketplace while it reviewed access and rebuilt the marketplace. The company has not published the timing of each response step.

Security analyses cited in the source material describe a loader inserted before the extension’s legitimate code. It ran when the editor loaded the extension, without requiring a user to click or open Claude Code. Researchers say the code attempted to collect information about the computer, add an attacker-controlled SSH public key, enable remote login, establish a tunnel to an attacker’s server, and persist across restarts.

Cursor said the SSH-enabling step required administrator privileges and failed on most Macs and Windows computers. That limits one reported route for remote access, but does not establish that every other action failed: the source says the key, startup entries and a data report still landed. Cursor also said the attacker’s server is now offline. The full number of users who received or ran the build has not been disclosed.

What the Cursor Listing Put at Risk

The incident matters because the modified package appeared as an update to the real Claude Code extension listing, rather than as an obvious copycat with a misspelled name. According to the security researchers cited in the report, the extension’s code ran when it loaded in Cursor. A user relying on the listing’s name and identifier could not tell from those details alone that this build was different.

For developers, an editor extension can operate in an environment containing source code, local files and development tools. The reported attempt to add an SSH key and configure persistence raises concerns beyond a single extension session: if a machine was affected, users may need to check for changes and protect credentials accessible from it. The potential scale remains limited by Cursor’s estimate of up to 5,000 users, and that figure is not a confirmed count of infected machines.

The episode also leaves a trust question for extension marketplaces: how was an altered build published under Anthropic’s extension identity? Cursor has not explained the publication path. Until that is clarified, users cannot assess from the public account alone whether the issue arose from a compromised publisher account, a marketplace process, or another route.

Popular right now

Ninja Foodi DualZone 10-Qt Air Fryer, 6-in-1, Black (DZ302)

AmazonView Latest Price

Ninja Foodi 10-Qt DualZone Smart XL Air Fryer, 6-in-1, DZ550

AmazonView Latest Price

Bose QuietComfort Ultra Wireless Noise-Cancelling Headphones with Spatial Audio, Black

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How Version 2.1.313 Appeared

Anthropic’s public GitHub release history, as described in the source material, moved from Claude Code 2.1.312 to 2.1.314; it contains no official 2.1.313 release. Version 2.1.312 was published on October 27, and Anthropic released 2.1.314 on October 30. The numbering is one indication that the Cursor build was not an official Anthropic release, but the central issue was its presence in Cursor’s marketplace under the familiar extension identity.

Cursor’s statement places the affected distribution in its VS Code extension marketplace. The source material says Claude Code obtained from Microsoft’s Visual Studio Marketplace, Open VSX, and the npm package was not affected. Early reports that named Open VSX were corrected, so those channels should not be conflated with the Cursor listing.

Anthropic said its own systems and employee laptops were not compromised and that its official distribution channels were unaffected. Cursor said it audited marketplace access, rotated keys, rebuilt the marketplace and later restored it. Those steps describe Cursor’s response; they do not, by themselves, explain how the modified extension was published.

„At most 5,000 users“

— Cursor

What the Public Record Leaves Open

How the altered package entered the marketplace remains unexplained. Cursor has not publicly described the publishing path or identified who uploaded the build. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but that wording does not specify how the access was obtained or which controls failed.

The precise number of users who downloaded, loaded or executed the extension is also unknown. Cursor’s figure of up to 5,000 is an upper estimate of potential impact, not a verified infection total. The available account does not say how many systems received the SSH key or startup entries, or whether any data was accessed by an attacker.

Reports also differ about who first detected the incident. Cursor said it identified the problem; The Register credited Phorion with first spotting it, while OpenSourceMalware thanked a developer who alerted the group. The source material does not settle that timeline. Cursor’s statement that the attacker’s server is offline addresses its current availability, but does not establish whether any data was collected before it went offline.

Checks for Cursor Claude Code Users

Cursor users who installed Claude Code through its marketplace during the exposure window should run Cursor’s check for an SSH key labeled svc-telemetry. The source material says uninstalling the extension alone is not enough if the machine was affected. Users who find the key are advised to use Cursor’s cleanup scripts, consider rebuilding the computer, and change credentials from a separate, trusted device.

Cursor says it will contact potentially affected users directly. The companies’ public statements and further technical findings may clarify the scope and how the package was published. Until then, users should follow Cursor’s own incident guidance and treat the presence or absence of the named key as a check—not, on its own, a complete account of whether a system was exposed.

Key Questions

Was the tampered Claude Code update an official Anthropic release?

No. The source material says the version available in Cursor’s marketplace was not built by Anthropic. Anthropic’s public release history went from 2.1.312 to 2.1.314, with no official 2.1.313 release listed.

Could the extension run without a click?

According to the security analyses cited in the report, the added loader ran when Cursor loaded the extension. A user did not need to open Claude Code or click a prompt for that code to run.

How many users were affected?

Cursor said up to 5,000 users may have been affected. That is an upper estimate, not a confirmed count of users whose computers were compromised or accessed.

What should I check on my computer?

If you used Claude Code from Cursor’s marketplace during the exposure period, run Cursor’s check for an SSH key labeled svc-telemetry. If it is present, Cursor’s guidance calls for cleanup scripts; it also advises considering a rebuild and changing credentials from a different, trusted computer.

Were Claude Code users on other platforms affected?

The source material says the versions from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports naming Open VSX were corrected; the reported incident concerned Cursor’s marketplace.

Source: ThorstenMeyerAI.com