Up To 5,000 Cursor Users May Need To Check This Claude Code Update

🔍 Read the full analysis: Up To 5,000 Cursor Users May Need To Check This Claude Code Update on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Cursor says a tampered Anthropic Claude Code extension was available in its marketplace for about 11 hours on Oct. 29, potentially affecting up to 5,000 users. The build, version 2.1.313, carried the real extension name and identifier but was not made by Anthropic; it attempted to gather computer information and create persistent remote access, according to Cursor and security researchers.

Cursor said the modified extension was listed from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 29. The company removed the version after detecting it, blocked further distribution and temporarily shut down its VS Code extension marketplace while it reviewed access, rotated keys and rebuilt the marketplace. Cursor has said the build may have reached no more than 5,000 users, not that all of those users installed or ran it.

Researchers described a small malicious loader placed ahead of the extension’s legitimate code. It ran when the editor loaded the extension, without requiring the user to open Claude Code or click a prompt. The reported actions included collecting details about the computer, adding an attacker-controlled SSH public key, attempting to enable remote login, opening a tunnel to an external server and setting up persistence across restarts.

Cursor said the attempt to enable SSH required administrator privileges and failed on most Macs and Windows computers. That limits what the attackers could do through the remote-login route, but does not establish that every other action failed. The attacker’s server is now offline, according to the source report. Cursor recommends checking for an SSH key labeled svc-telemetry; if found, users should not assume uninstalling the extension removes all changes.

Why Extension Updates Matter

The incident shows how a compromised software distribution channel can make a malicious package appear to be a routine update. Because the altered build used the real extension identifier, users who rely on automatic updates could have received it without searching for or installing a separate look-alike listing. The incident is therefore relevant beyond Claude Code: developer extensions can run with access to local files, source code and tools available to the editor.

The reported SSH step did not succeed on most Macs and Windows PCs, Cursor said, but the attempted collection and persistence still make it prudent for potentially affected users to investigate. Developers’ machines can hold credentials, private source code and access to work systems. Cursor’s estimate of up to 5,000 users describes the possible reach, while the number of installations, successful compromises and affected organizations has not been made public in the supplied material.

Products Worth Considering

Apple iMac 2024 All-in-One Desktop with M4 Chip, 24‑inch Retina Display, 16GB Unified Memory, 256GB SSD, Silver

AmazonView Latest Price

Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD

AmazonView Latest Price

Apple Mac mini (2026) with M5 Pro chip and 3-year AppleCare+

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Cursor Listing Was Altered

The source account says Anthropic’s last official release before the incident was Claude Code 2.1.312, published on GitHub on Oct. 27. The modified 2.1.313 then appeared in Cursor’s VS Code extension marketplace on Oct. 29. Anthropic’s public release list moved from 2.1.312 to 2.1.314, which Anthropic released early on Oct. 30; the list had no 2.1.313 entry when checked that day.

Cursor said it removed the affected version and later restored its marketplace after taking security steps. Anthropic said its own systems and employee laptops were not compromised. The source material also says early reports identifying Open VSX as the distribution source were corrected: the reported affected channel was Cursor’s marketplace. Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not identified as affected in the account.

Public accounts differ on who first detected the issue. Cursor said it identified the incident; The Register credited Phorion with spotting it, while OpenSourceMalware thanked a developer who alerted it. The available material does not settle that sequence.

“The modified extension was impacting at most 5,000 users.”

— Cursor

What Investigators Have Not Explained

How the altered build entered Cursor’s marketplace under Anthropic’s extension identity remains unexplained in the supplied source material. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not publicly described the route by which the package was published or whose account or process was involved.

It is also not clear how many users installed the extension during the exposure window, how many machines had the malicious code run, or whether any data was successfully sent to the attacker. Cursor’s statement that SSH activation failed on most Macs and Windows PCs does not specify the number of exceptions or confirm that the other attempted actions were harmless. The source account says the attacker’s server is offline, but does not establish whether any information was collected before it went offline.

Checks for Cursor Claude Code Users

Cursor users who installed or updated Claude Code during the exposure period should follow the company’s published check for the svc-telemetry SSH key. The source material says users who find it should use Cursor’s cleanup scripts; simply uninstalling the extension is not enough. It also advises considering a rebuild of the machine and changing credentials from a separate, trusted computer.

Cursor said it would contact potentially affected users directly. Users should watch for that notice and consult Cursor’s official incident guidance for the applicable cleanup steps. The public material provided for this report does not include a completed investigation explaining how the marketplace listing was altered, so the incident’s entry point and full scope remain open.

Key Questions

Which Claude Code version was involved?

The reported malicious build was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public release list went from version 2.1.312 to 2.1.314.

How many users may have been affected?

Cursor said the altered extension could have affected up to 5,000 users. That is a maximum estimate; the supplied information does not say how many people installed it or had malicious actions succeed.

What should a potentially affected user check?

Check for an SSH key labeled svc-telemetry using Cursor’s guidance. If it is present, Cursor’s cleanup scripts are recommended; uninstalling the extension alone may not undo changes.

Were Claude Code users on other marketplaces affected?

The source account identifies Cursor’s marketplace as the affected channel and says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected. Early reports naming Open VSX were corrected.

How did the modified extension get published?

That has not been explained publicly in the supplied material. Anthropic said a malicious actor used access to Cursor’s marketplace, while Cursor has not described how the build was submitted under the extension’s identity.

Source: ThorstenMeyerAI.com