TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A modified Claude Code extension, version 2.1.313, was available through Cursor’s extension marketplace for about 11 hours on Oct. 29. Cursor says up to 5,000 users may have been affected; users should check for an SSH key labeled svc-telemetry and follow Cursor’s cleanup guidance if it appears.
Cursor says version 2.1.313 was available from about 09:27 to 20:35 UTC on Oct. 29. The company said it removed the version after detecting the incident, blocked further distribution, and temporarily shut down its VS Code extension marketplace. Cursor said it audited access, rotated keys, rebuilt the marketplace and restored it, though it has not published timings for those steps.
Researchers reported that the extension ran when the editor loaded it, without requiring a user to click a prompt. It collected information about the computer and attempted to add an attacker-controlled SSH key, enable remote login, open a tunnel to an attacker’s server and persist across restarts. Cursor said enabling SSH required administrator privileges and failed on most Macs and Windows PCs. That may have prevented remote login on those machines, but the key, startup entries and data report could still have been created or sent.
Cursor said the attacker’s server is now offline. Anthropic said its own systems were not compromised and that its official distribution channels were unaffected. Researchers and the vendors said the incident was limited to Cursor’s marketplace; Claude Code distributed through Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected. Early reports that named Open VSX were corrected.
Security Briefing · Cursor Marketplace · Oct. 29, 2026
A Claude Code Update Reached Up To 5,000 Cursor Users—Here’s What To Check
A modified extension was available for about 11 hours. Cursor says up to 5,000 users may have received it. Check for an SSH key labeled svc-telemetry and follow Cursor’s cleanup guidance if it appears.
01 / What happened
A trusted name, altered build
The modified Claude Code extension used Anthropic’s name and identifier, but Cursor and researchers said it was not made by Anthropic. The reported source was Cursor’s extension marketplace.
Cursor only
Cursor’s VS Code extension marketplace carried the affected listing. Microsoft’s Visual Studio Marketplace, Open VSX, and npm were reported unaffected. Early reports naming Open VSX were corrected.
Automatic updates mattered
Researchers said the extension ran when the editor loaded it, without a separate prompt click. Users with automatic updates enabled may have received the build.
Listing removed
Cursor says it removed the version, blocked further distribution, temporarily shut down its marketplace, audited access, rotated keys, rebuilt the marketplace, and restored it.
02 / Timeline
How the listing moved
The extension marketplace is a separate channel from Anthropic’s official releases.
Oct. 27
Anthropic published Claude Code 2.1.312 on GitHub, according to the source material.
Oct. 29 · 09:27 UTC
Modified version 2.1.313 appeared in Cursor’s marketplace under the identifier anthropic.claude-code.
Oct. 29 · 20:35 UTC
Cursor says the listing was removed after about 11 hours and further distribution was blocked.
Oct. 30 · 01:06 UTC
Anthropic’s public release list moved to 2.1.314, with no 2.1.313 entry.
03 / Reported behavior
What the modified build attempted
Researchers reported that it gathered computer information and tried to establish remote access and persistence. Cursor says SSH activation required administrator privileges and failed on most Macs and Windows PCs.
A failed SSH setup may have blocked that route on many machines. It does not establish that every other action failed: a key, startup entry, or data report could still have been created or sent. Cursor says the attacker’s server is now offline.
“impacting at most 5,000 users”Cursor
“wasn’t a compromise of Anthropic’s systems or employee laptops.”Felix Rieseberg · Anthropic technical staff
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”Jenn Gile · OpenSourceMalware, via The Hacker News
04 / What to do
Check first. Follow the cleanup guidance.
Search for the key label
Cursor users with Claude Code should run the company’s check for the reported SSH key.
svc-telemetryIf it appears, use Cursor’s current cleanup scripts and security instructions. The source material says simply uninstalling the extension is insufficient.
- Use Cursor’s cleanup steps. Consider rebuilding the machine if its guidance recommends it.
- Change credentials from a separate trusted computer if Cursor’s instructions call for it.
- Watch for direct notice. Cursor says it will contact affected users.
- Recheck current guidance. Findings may change as Cursor and researchers publish updates.
05 / Known and unknown
What the public account leaves open
How many people installed or ran it?
Cursor’s “up to 5,000” figure is an upper bound. The number of actual installations or runs has not been established in the cited material.
How was the listing altered?
Neither company has publicly explained how the modified build was published under Anthropic’s extension identity or which account or process was involved.
Did it reach every Claude Code channel?
No. The reports describe distribution through Cursor’s marketplace. Microsoft’s Visual Studio Marketplace, Open VSX, and npm were reported unaffected.
Were Anthropic’s systems breached?
Anthropic said its systems and employee laptops were not compromised. The reported incident concerned Cursor’s marketplace.
Who first detected it?
Public accounts differ: Cursor said it identified the problem; The Register credited Phorion, while OpenSourceMalware acknowledged a developer who alerted the group. The sequence remains unsettled.
What exposure occurred on affected devices?
It remains unclear how many machines received a key, startup entries, or data-report activity—or whether credentials or sensitive files were accessed.
Risks for Cursor Extension Users
The incident shows how a compromised software listing can deliver harmful code under the name and identifier of a trusted extension. Users who rely on automatic updates may have received the build without taking a separate action, according to Jenn Gile, co-founder of OpenSourceMalware, in comments reported by The Hacker News.
For people who installed the affected version, the potential impact depends on what the extension managed to do on each computer. Cursor’s account that SSH activation failed on most Macs and Windows PCs narrows one reported route to remote access, but it does not establish that every other action failed. Users should treat Cursor’s svc-telemetry check and cleanup instructions as the practical next step, and change credentials from a separate trusted device if Cursor’s guidance calls for it.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Apple MacBook Pro 2021 16‑inch with M1 Max, 32 GB RAM, 2 TB SSD, Space Gray (QWERTY English)
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Malicious Build Reached Cursor
Anthropic published Claude Code 2.1.312 on GitHub on Oct. 27, according to the source material. The altered 2.1.313 appeared in Cursor’s VS Code extension marketplace early on Oct. 29. Anthropic’s public GitHub release list later moved from 2.1.312 to 2.1.314, released at 01:06 UTC on Oct. 30, with no 2.1.313 entry.
Cursor’s marketplace is a separate distribution channel from Anthropic’s official releases. The affected listing reportedly carried the genuine extension identifier, anthropic.claude-code, rather than a similar-looking name. Cursor’s notice and researchers’ analyses identify Cursor’s marketplace as the source. Some initial reports attributed the build to Open VSX, but those reports were corrected.
Public accounts differ on who first detected the incident. Cursor said it identified the problem; The Register credited security firm Phorion with spotting it, while OpenSourceMalware acknowledged a developer who alerted the group. The available accounts do not settle the sequence.
““impacting at most 5,000 users””
— Cursor
Questions About Access and Exposure
Neither company has publicly explained how the altered build was published under Anthropic’s extension identity. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but the source material does not specify how that access was obtained or which account or process was involved.
Cursor’s figure of up to 5,000 users is an upper bound; the number who actually installed or ran the build has not been established in the cited material. It is also unclear how many machines received the SSH key, startup entries or data-report activity, and whether any user credentials or other sensitive files were accessed. The attacker’s server being offline does not answer those questions.
Checks and Vendor Follow-Up
Cursor users with Claude Code should run the company’s check for an SSH key labeled svc-telemetry. If it appears, the source material says uninstalling the extension alone is insufficient: users should use Cursor’s cleanup scripts, consider rebuilding the machine and change credentials from another trusted computer, following Cursor’s current security instructions.
Cursor says it will contact affected users directly. Further details from Cursor about how the listing was altered, the number of confirmed installations and the results of its marketplace access audit would clarify the incident. Users should also check for updates to Cursor’s guidance as the company and security researchers publish additional findings.
Key Questions
Which Claude Code version was involved?
The affected build was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public GitHub release list has no 2.1.313 entry and shows 2.1.312 followed by 2.1.314.
How long was the extension available?
Cursor says the modified extension was available from about 09:27 to 20:35 UTC on Oct. 29, 2026, or roughly 11 hours.
Was Claude Code from every source affected?
No. The source material says the affected distribution was Cursor’s marketplace. Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were reported unaffected; early reports naming Open VSX were corrected.
What should Cursor users check?
Check for an SSH key labeled svc-telemetry using Cursor’s instructions. If it is present, Cursor’s guidance and the source material call for cleanup beyond simply uninstalling the extension.
Does the incident mean Anthropic’s systems were breached?
Anthropic said its systems and employee laptops were not compromised. The public accounts describe a malicious build distributed through Cursor’s marketplace, while the method used to publish it under the extension’s identity remains unclear.
Source: Thorsten Meyer AI
