A Familiar Name, Tampered Code: What Cursor Users Need To Know

🔍 Read the full analysis: A Familiar Name, Tampered Code: What Cursor Users Need To Know on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

A tampered Anthropic Claude Code extension was available in Cursor’s extension marketplace for about 11 hours on October 29, and Cursor says up to 5,000 users may have received it. The modified version used the real extension name and identifier, but Cursor says it was not built by Anthropic; the code attempted to establish persistent access to affected computers.

Cursor says version 2.1.313 was listed from 09:27 to 20:35 UTC on October 29. The company says it removed the version after detecting the incident, blocked further distribution and temporarily shut down its VS Code marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor has not publicly explained how the modified build was published under Anthropic’s extension identity.

Analyses by security firms Phorion and OpenSourceMalware describe a loader placed ahead of the extension’s legitimate code. It ran when the editor loaded the extension, without requiring a separate click, and attempted to collect computer details, add an attacker-controlled SSH key, enable remote login and open a tunnel to an external server. Cursor says enabling SSH required administrator privileges and failed on most Mac and Windows computers. The attacker’s server is now offline, according to the source report; that does not establish that every attempted action failed.

Cursor and the researchers said the affected distribution was in Cursor’s marketplace. The source report says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and the npm package were not affected; early reports that named Open VSX were later corrected. Anthropic’s public release history went from version 2.1.312 to 2.1.314, with no official 2.1.313 release listed when checked on October 30.

Why a Trusted Listing Was Not Enough

The incident matters because the extension appeared under the real name and identifier, rather than as an obvious imitation with a misspelled title. Users who relied on the listing’s identity—or had automatic updates enabled—could have received the altered build without deliberately seeking it out. It shows how risk can enter through a software distribution channel even when the publisher’s own release is not compromised.

Code editor extensions can access local files, source code and developer tools when loaded. That makes the attempted SSH access and persistence especially relevant for developers whose computers hold work credentials, source repositories or access to company systems. Cursor says the SSH step failed on most systems, but the loader also attempted other actions; users should not treat that limitation as proof that an installation was harmless.

The incident also leaves a trust question for extension marketplaces: users need to know how publishers are authenticated and how a package came to be associated with a recognized identity. Cursor has not provided a public account of that publishing path, so the available information does not establish whether the cause was a compromised account, a marketplace control failure or another route.

Popular right now

Shark Rotator Lift-Away Vacuum with DuoClean PowerFins (LA555) – Dark Grey

AmazonView Latest Price

Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ

AmazonView Latest Price

KitchenAid Artisan 5-Qt Tilt-Head Stand Mixer – Almond Cream (KSM150PS)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How Version 2.1.313 Appeared

Anthropic published Claude Code 2.1.312 on October 27, according to the source report’s review of the project’s release history. Two days later, the modified 2.1.313 appeared in Cursor’s VS Code extension marketplace. Anthropic released 2.1.314 on October 30, and its public listing skipped 2.1.313.

Cursor said the affected build targeted Apple-silicon Macs and 64-bit Windows. Its notice put the marketplace window at 2:27 a.m. to 1:35 p.m. Pacific time on October 29. Cursor later described the possible reach as at most 5,000 users; that is an upper limit, not a confirmed count of infected machines.

Anthropic staff member Felix Rieseberg said the event was not a compromise of Anthropic’s systems or employee laptops. The report also quotes Anthropic as saying a malicious actor “used access to Cursor’s marketplace.” Those statements address Anthropic’s infrastructure but do not explain how the actor gained the access needed to publish the altered extension.

““impacting at most 5,000 users””

— Cursor

The Publishing Route Remains Unknown

Cursor has not explained how the altered build entered its marketplace under Anthropic’s extension identity. Anthropic’s statement that the actor used access to Cursor’s marketplace does not specify whether that access came from a compromised account, a weakness in marketplace controls or another cause. The public record described in the source material also does not settle who first detected the incident.

The number of actual installations and the extent of any successful data collection remain unclear. Cursor’s 5,000 figure is a maximum estimate of affected users, not a verified infection total. The source material says SSH activation failed on most Mac and Windows systems and that the attacker’s server is offline, but it does not establish what information, if any, was transmitted from individual devices. Cursor said it would contact affected users directly.

Checks and Cleanup for Users

Cursor users who installed or updated Claude Code during the incident window should run Cursor’s check for a key labelled “svc-telemetry”. The source report warns that uninstalling the extension alone is not sufficient if the malicious code made system changes. Users who find the key should follow Cursor’s cleanup scripts; rebuilding the machine may also be appropriate, and credentials should be changed from a separate, trusted computer.

Cursor said it would contact users it identified as affected. Users should look for that direct notice and follow the company’s published cleanup instructions rather than relying only on removal of the extension. The companies have not yet released a public explanation of the marketplace publishing route or a confirmed count of devices on which the attempted actions succeeded.

Key Questions

Which Claude Code version was affected?

The modified version was 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public release history listed 2.1.312 before the incident and 2.1.314 afterward, with no official 2.1.313 release shown on October 30.

How can Cursor users check whether they were affected?

Run Cursor’s check for a key labelled “svc-telemetry.” If it appears, follow Cursor’s cleanup guidance; simply uninstalling the extension may not remove changes made by the modified build.

Does the incident mean Anthropic’s systems were breached?

Anthropic staff member Felix Rieseberg said the incident was not a compromise of Anthropic’s systems or employee laptops. The modified extension was distributed through Cursor’s marketplace, and the route used to publish it remains unexplained publicly.

Were extensions from other marketplaces affected?

The source report says Claude Code from Microsoft’s Visual Studio Marketplace, Open VSX and npm was not affected. It notes that early reports naming Open VSX were corrected.

How many users installed the modified extension?

Cursor said at most 5,000 users may have been affected. That is a maximum estimate, not a confirmed count of installations or devices where the attempted actions succeeded.

Source: ThorstenMeyerAI.com