TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29 and may have reached up to 5,000 users. Users should check for an SSH key labelled svc-telemetry; Cursor says affected users should use its cleanup scripts and change credentials from a trusted device.
Cursor says a maliciously modified Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The version, 2.1.313, used the name and identifier of Anthropic’s Claude Code extension, but Cursor says it was not built by Anthropic. The incident matters because users could receive it through an update to the listing they already used.
Cursor places the availability window at 09:27 to 20:35 UTC on October 29. It says it removed the version after detection, blocked further distribution and temporarily shut down its VS Code marketplace. Cursor later said it audited access, rotated keys, rebuilt the marketplace and brought it back online. Its estimate is “at most 5,000 users”; that is a ceiling supplied by the company, not a confirmed count of machines where the code ran.
Security researchers who analysed the extension reported that it could run when the editor loaded it, without a separate click. The code attempted to collect computer details, add an attacker-controlled SSH key, enable remote login, connect to an attacker’s server and persist across restarts. Cursor says enabling SSH required administrator rights and that the step failed on most Macs and Windows PCs. That limitation does not establish that every other action failed: Cursor’s notice says the key, startup entries and a data report were still delivered.
Cursor recommends that users of Claude Code in Cursor check for a key labelled svc-telemetry. According to the source material, removing the extension alone is not sufficient if the device was affected. Cursor points users to cleanup scripts; the guidance also says to consider rebuilding the machine and to change credentials from a separate, trusted computer.
Security Briefing / Cursor Marketplace
5 Checks To Make After The Tampered Claude Code Update Reached Cursor Users
Cursor says a maliciously modified Claude Code extension, version 2.1.313, was available in its marketplace for about 11 hours on October 29, 2026. The company estimates it could have reached up to 5,000 users. Here is what to check, what is known, and where the public account still has gaps.
01 / User action
Five checks to make now
If you installed or updated Claude Code through Cursor around October 29, follow Cursor’s current incident notice. The checks below reflect the guidance in the source material; use a separate, trusted device for credential changes.
Inspect SSH keys
Look for “svc-telemetry”
Check whether an SSH key with this label was added. Cursor specifically recommends looking for it as part of its published guidance.
Use official cleanup
Run Cursor’s cleanup scripts
If the key or other suspicious changes are present, use the cleanup scripts linked from Cursor’s incident notice and follow its latest instructions.
Review persistence
Check for more than the extension
Researchers reported attempts to add startup entries and establish persistence. Removing the extension alone may not undo other changes.
Assess the device
Consider a rebuild if affected
The source guidance says to consider rebuilding the machine. Cursor’s administrator-rights caveat applies to the SSH step, not necessarily every attempted action.
Protect accounts
Change credentials from a trusted computer
Change potentially exposed credentials from a separate device you trust. Review Cursor’s notice for current advice and any direct message to affected users.
Keep evidence in view
Do not read “failed on most” as “nothing happened”
Cursor says enabling SSH required administrator rights and failed on most Macs and Windows PCs. Its notice also says a key, startup entries and a data report were delivered.
Uninstalling the extension may not be sufficient if the device was affected. Check Cursor’s incident notice for the current cleanup scripts and instructions.
02 / What the reports describe
Why this listing mattered
The reported build used the name and identifier of Anthropic’s Claude Code extension, but Cursor says it was not built by Anthropic. A compromised update through a familiar listing can reach people who did not choose a separate extension.
A familiar update channel
Cursor says version 2.1.313 was available in its VS Code extension marketplace from 09:27 to 20:35 UTC. Users with automatic updates enabled may have received it without choosing a new listing or approving a distinct installation.
Editor access can reach sensitive work
Researchers said the extension could run when the editor loaded it. Reported actions included collecting computer details, attempting to add an attacker-controlled SSH key, enabling remote login, contacting a server and persisting across restarts.
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
Jenn Gile, co-founder of OpenSourceMalware, quoted by The Hacker News03 / Scope and response
One marketplace channel was identified
The available reporting focuses on Cursor’s extension marketplace. It does not describe every Claude Code installation as affected.
Cursor VS Code extension marketplace
Modified version 2.1.313, available for about 11 hours on October 29, according to Cursor.
Other named distribution channels
Microsoft Visual Studio Marketplace, Open VSX and npm were reported unaffected by vendors and researchers in the source material. Early reports naming Open VSX were corrected.
Anthropic’s public GitHub releases
The reported history moved from 2.1.312 to 2.1.314, with no official 2.1.313 entry. Anthropic said its systems and official channels were not compromised.
Removal, audit and rebuild
Cursor says it removed the version, blocked further distribution, temporarily shut down its VS Code marketplace, audited access, rotated keys, rebuilt the marketplace and restored service.
Version listed
09:27 UTC, October 29
Listing removed
Cursor says it stopped distribution
Marketplace reviewed
Access audit and key rotation reported
Service restored
Marketplace rebuilt and brought back online
04 / Open questions
What investigators have not explained
The public reporting describes a response, but does not provide a full forensic account. These unknowns limit what can be concluded from the reported maximum reach or the failed SSH step.
Cursor has not publicly explained how the altered build appeared under Anthropic’s extension identity, or whether a publisher account, marketplace process or other access route was involved.
The number of users who installed or ran the version, devices that sent a data report and any successful interactive remote sessions remain unclear.
Public accounts differ on who first spotted the activity. The available material does not settle the sequence or include a final forensic report.
“At most 5,000 users” is Cursor’s estimate of potential reach. It is not a confirmed count of infected machines or successful remote access.
Why the Store Listing Matters
The incident shows the risk of distributing a compromised update through a familiar extension listing. This was reported as a modified build under the real extension name and identifier, rather than a separate listing with a misleadingly similar name. Users who had automatic extension updates enabled may have received it without choosing a new extension or approving a distinct installation, according to Jenn Gile of OpenSourceMalware, quoted by The Hacker News.
Code editors often have access to source files, terminals and development credentials. The reported attempt to establish remote access therefore raised concerns beyond the editor itself. Cursor says the administrator requirement prevented the SSH step on most Macs and Windows PCs, but that is a statement about that step and those devices. It does not show that no systems were affected or that all attempted data collection was unsuccessful.
For users, the practical consequence is to check the device and credentials that may have been exposed, rather than relying only on uninstalling the extension. For software marketplaces, the case also puts attention on how publishers are authenticated and how updates are reviewed. Cursor has not publicly explained how the modified build appeared under Anthropic’s extension identity.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Sonos Era 100 SL Compact, Microphone-Free Speaker – Black
As an affiliate, we earn on qualifying purchases.
Which Claude Code Channels Were Affected
The affected distribution channel identified in the available reporting is Cursor’s VS Code extension marketplace. Cursor says the modified version was available there from 09:27 to 20:35 UTC on October 29. Anthropic’s public GitHub release history went from version 2.1.312, published October 27, to version 2.1.314, published early October 30; it contains no official 2.1.313 entry, according to the source material’s check on October 30.
Anthropic said its own systems were not compromised and its official channels were not affected. The source material also says Claude Code distributions through Microsoft’s Visual Studio Marketplace, Open VSX and npm were not affected, according to vendors and researchers. Early reports that named Open VSX were corrected. Those distinctions matter: the available account concerns a specific listing in Cursor’s marketplace, rather than every installation of Claude Code.
The public timeline does not identify who first detected the problem. Cursor said it identified the incident; The Register credited Phorion with first spotting it; OpenSourceMalware thanked a developer who alerted the group. Those accounts do not settle the sequence. The public reporting describes an investigation and marketplace response, but provides no detailed account of how the altered package passed the store’s publishing controls.
““Anyone who has their Claude Code instance set to auto-update could have consumed the malware.””
— Jenn Gile, co-founder of OpenSourceMalware, quoted by The Hacker News
What Investigators Have Not Explained
The central unanswered question is how the altered build was published under Anthropic’s extension identity. Cursor has not publicly detailed the route used to upload it or whether the publisher account, a marketplace process or another access path was involved. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but that wording does not provide a technical explanation of the access or the publishing process.
It is also not clear how many users installed or ran version 2.1.313, how many devices received the reported data report, or whether any attacker gained an interactive remote session. Cursor’s statement that the SSH-enabling step failed on most Macs and Windows PCs gives no exact device count. The attacker’s server is reported to be offline, but that does not by itself establish what data may have been collected before it went offline.
Public accounts also differ on who first noticed the activity. No complete detection timeline has been published in the material provided. The reported maximum of 5,000 users and the researchers’ analysis are the available public figures; the source material does not include a final forensic report.
Checks for Cursor Users
Users who installed or updated Claude Code through Cursor around October 29 should first check for an SSH key labelled svc-telemetry, following Cursor’s published guidance. If the key is present, the source material advises using Cursor’s cleanup scripts; simply uninstalling the extension may not remove other changes. Cursor’s response also advises considering a rebuild of the machine and changing credentials from a separate, trusted computer.
Users should review Cursor’s incident notice for the current cleanup instructions and any direct message from the company. Cursor said it would contact affected users directly, but the source material does not give a completion date for those notifications. Anthropic and Cursor may provide further details about the marketplace access path, the scope of exposure and the investigation. Until then, the company estimates, researcher findings and the specific channel identified in the notices should be kept distinct from independently verified device-by-device results.
Key Questions
What happened to the Claude Code extension in Cursor?
Cursor says a modified version, 2.1.313, was available in its VS Code extension marketplace for about 11 hours on October 29. Cursor says it was not built by Anthropic and may have reached up to 5,000 users.
How can Cursor users check their devices?
Check for an SSH key labelled svc-telemetry and follow Cursor’s incident guidance. If the key is present, the source material says to use Cursor’s cleanup scripts; uninstalling the extension alone may not be enough.
Did the malicious extension affect every Claude Code user?
No. The reported incident concerns the listing in Cursor’s marketplace. Anthropic and researchers said the Microsoft Visual Studio Marketplace, Open VSX and npm distributions were not affected. Early reports naming Open VSX were corrected.
Was Anthropic compromised?
Anthropic said its own systems and employee laptops were not compromised and that its official channels were unaffected. The public account identifies a modified extension in Cursor’s marketplace; it does not yet explain how that build was published there.
Source: Thorsten Meyer AI
