By Thorsten Meyer | October 30, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
For about eleven hours on Thursday, 29 October, anyone who installed or updated Anthropic’s Claude Code extension inside the Cursor code editor could have received version 2.1.313. It had the right name and the right extension ID. It was not built by Anthropic. In front of the normal code sat a small loader that tried to give a stranger a lasting way into the machine.
Cursor, which runs the extension store the build came from, says at most 5,000 users were affected and that it will contact them directly. Anthropic says its own systems were not compromised and its official channels are not affected. Neither company has explained how the tampered build got into Cursor’s store under Anthropic’s name.
Here is the timeline, what the code tried to do, who says what, and the one check every Cursor user with this extension should run today.
Key takeaways
- What happened: A maliciously modified Anthropic.claude-code version 2.1.313 was available in Cursor’s VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific time on 29 October (09:27 to 20:35 UTC), according to Cursor. Cursor says it was not developed by Anthropic and affected at most 5,000 users.
- What it tried: Collect details about the computer, add an attacker’s SSH key, switch on remote login, open a tunnel to the attacker’s server, and survive restarts. Researchers found it ran as soon as the editor loaded the extension. No click needed.
- The twist: Switching on SSH needs administrator rights. Cursor says that step failed on most Macs and Windows PCs, so the attacker could not log in through the tunnel there, and the attacker’s server is now offline. The key, the startup entries and the data report still landed.
- Not affected, per the vendors and researchers: Claude Code from Microsoft’s Visual Studio Marketplace, from Open VSX, and the npm package. Early reports naming Open VSX were corrected.
- Still open: How the attacker published under Anthropic’s extension identity. Cursor has not said. Anthropic says a malicious actor “used access to Cursor’s marketplace”.
- What to do: If you use Cursor with Claude Code, run Cursor’s check for a key labelled svc-telemetry. If it is there, uninstalling is not enough: use Cursor’s cleanup scripts, consider rebuilding the machine, and change credentials from a different, trusted computer.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with 1 CMOS & 4K/120fps
As an affiliate, we earn on qualifying purchases.
The short answer
This was not a look-alike extension with a typo in its name, the classic trick in extension stores. The bad build arrived as an update to the real listing, under the real identifier anthropic.claude-code, according to The Hacker News and the researchers who analysed it. If your editor updates extensions automatically, you could have received it without doing anything.
“It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware,” Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News.
That makes this a supply-chain attack on a distribution channel. The software you trust arrives through the channel you trust, and the name tag tells you nothing.
The timeline
All times are as published by the sources, converted to UTC. Pacific time was UTC−7 that day.
- Tue 27 Oct, 20:24 UTC: Anthropic publishes Claude Code 2.1.312 on GitHub, the last official release before the incident.
- Thu 29 Oct, 09:27 UTC (2:27 a.m. PT): A maliciously modified 2.1.313 becomes available in Cursor’s VS Code extension marketplace. Cursor names modified builds for Apple-silicon Macs and 64-bit Windows.
- 29 Oct, 20:35 UTC (1:35 p.m. PT): The window closes. Cursor says it removed the version “immediately upon detection”, blocked further distribution, then shut down its whole VS Code marketplace “out of an abundance of caution”. It audited access, rotated its keys, rebuilt the marketplace and brought it back online. It has not published times for those steps. Its security notice is dated 29 October.
- Fri 30 Oct, 01:06 UTC: Anthropic releases Claude Code 2.1.314 on GitHub. Its public release list goes from 2.1.312 straight to 2.1.314; there is no 2.1.313 entry (checked on 30 October).
- 30 Oct, 07:46 UTC: Cursor posts on X about a modified extension “impacting at most 5,000 users”.
- 30 Oct, morning UTC: Security firms Phorion and OpenSourceMalware publish analyses; Reuters reports Cursor’s figures. Some early reports name Open VSX as the source and are corrected during the day.
- 30 Oct, 14:08 UTC: Felix Rieseberg of Anthropic’s technical staff posts that it “wasn’t a compromise of Anthropic’s systems or employee laptops.”
Who noticed first is not clear from the public record. Cursor says “we identified” the incident; The Register credits Phorion with first spotting it; OpenSourceMalware thanks a developer who alerted it as it happened.
Infographic 01 · 29–30 October 2026
Eleven hours in the store.
How long the tampered Claude Code build was available in Cursor’s extension marketplace, and what happened next. Pacific time was UTC − 7.
- 2.1.312Official · 27 Oct, 20:24 UTC · GitHub
- 2.1.313Tampered · in Cursor’s store only · not built by Anthropic, per Cursor and Anthropic
- 2.1.314Official · 30 Oct, 01:06 UTC · GitHub
- 27 Oct · 20:24Claude Code 2.1.312GitHubLast official release before the incident
- 29 Oct · 09:27Tampered 2.1.313 appearsCursorIn Cursor’s VS Code extension marketplace; builds for Apple-silicon Macs and 64-bit Windows
- 29 Oct · 20:35Window closesCursorRemoved “immediately upon detection”; marketplace shut down, audited, keys rotated, rebuilt (times not published)
- 30 Oct · 01:06Claude Code 2.1.314GitHubAnthropic’s next official release
- 30 Oct · 07:46Cursor goes public on XCursor“Impacting at most 5,000 users”
- 30 Oct · morningAnalyses and reportsMediaPhorion, OpenSourceMalware, Reuters; early Open VSX claims corrected
- 30 Oct · 14:08Anthropic respondsAnthropic“It wasn’t a compromise of Anthropic’s systems or employee laptops”
Sources: Cursor security notice, 29 Oct 2026; Cursor on X, 30 Oct; Claude Code releases, GitHub (checked 30 Oct); Felix Rieseberg (Anthropic) on X, 30 Oct; Phorion, 30 Oct; OpenSourceMalware, 30 Oct; Reuters via CNA, 30 Oct.
Powered by Thorsten Meyer AI
What the tampered build tried to do
Think of an extension as a helper you let into your workshop. It gets the same access you have. Phorion puts it plainly: a backdoored extension “gets immediate access to local files, source code, and developer tooling as soon as its module is loaded.”
Cursor’s notice and the two research write-ups describe the same chain. Here it is at the level a defender needs, without the code:
- A small loader in front of the real code. The package looked like the normal extension. OpenSourceMalware counted a 66-line block placed before the legitimate code in the main file; the rest matched the normal version. It ran as soon as the editor loaded the extension. You did not have to open Claude Code or type anything.
- A spare key under the doormat. It added an attacker’s public key to the file that lists who may log in to your account over SSH, the remote-login tool developers use every day. The key carries the harmless-sounding label svc-telemetry.
- Trying to open the door. It tried to switch on the computer’s SSH service and to open an outbound tunnel to the attacker’s server. A tunnel like this lets someone outside reach the machine without an incoming connection that a firewall would normally block.
- Surviving a restart. It installed startup entries that retry the tunnel about every 60 seconds: a background agent with an Apple-style name on macOS, a scheduled task or startup script on Windows, a reboot entry on Linux.
- Reporting home. It sent the attacker the computer name, user name, operating system, folders, Git email address and public IP address, plus the names, not the values, of up to 40 environment variables that look like keys, tokens or passwords.
That last point matters more than it sounds. “Their names can still reveal which cloud providers, CI systems, and credential types are configured,” said OpenSourceMalware researcher Paul McCarty. OpenSourceMalware found no second download. Cursor warns that the limited collection “does not rule out later credential access over the backdoor.”
The twist: a bug that kept the door shut, mostly
On most machines, the most dangerous step failed. Turning on SSH needs administrator rights, which the extension did not have on most Macs and Windows PCs. Cursor says that outside “highly unusual circumstances where Cursor was started with administrator privileges”, errors in the malicious code made the step fail, and on those hosts “the attacker could not have logged in through the tunnel.”
Phorion traced the macOS failure to a faulty check: the code asked whether remote login was off without the rights to ask, got an error message back, and skipped the step that would have switched it on. BleepingComputer reports a separate error on Windows.
Two caveats keep this from being an all-clear:
- The key, the startup entries and the host report were still installed or sent. Cursor’s advice: “Follow the remediation steps below regardless.”
- Phorion warns the bug is nothing to rely on: “If the user already had Remote Login enabled, or turns it on later, the backdoor is ready and waiting.”
Cursor also says it worked with the cloud provider that hosted the attacker’s server to take it offline, so the tunnel and the data reports no longer reach anyone.
Infographic 02 · What the tampered build tried
Six steps. Most landed. The door mostly stayed shut.
The chain as Cursor and two security firms describe it, at the level a defender needs. No code, no recipe.
- 1 · On loadLandedThe loader runs66 lines placed before the real code run as soon as the editor loads the extension. No click needed.
- 2 · AccessLandedA spare key is plantedAn attacker’s public key is added to the SSH login list, labelled svc-telemetry.
- 3 · The doorMostly failedSSH is switched onNeeds administrator rights. Cursor: fails on most Macs and Windows PCs; Phorion found a faulty check on macOS.
- 4 · The tunnelNow offlineA tunnel to the attackerTried to open a tunnel to the attacker’s server. Cursor says that server has been taken offline.
- 5 · PersistenceLandedStartup entriesRetry the tunnel about every 60 s and survive restarts. Uninstalling the extension does not remove them.
- 6 · The reportLandedHost details sentComputer and user name, OS, Git email, public IP, and names (not values) of up to 40 secret-like variables.
Why the worst step mostly failed
- Turning on SSH needs administrator rights the extension did not have on most machines (Cursor)
- “Due to errors in the malicious code, this step would fail” outside unusual cases where Cursor ran as administrator (Cursor)
- The attacker’s server is offline, so tunnel and reports reach no one now (Cursor)
Why it is still serious
- Key, startup entries and the host report landed anyway (Cursor)
- Where remote login was already on, or is switched on later, “the backdoor is ready and waiting” (Phorion)
- The report tells an attacker which machines hold cloud and API credentials (OpenSourceMalware)
Sources: Cursor security notice, 29 Oct 2026; Phorion, 30 Oct; OpenSourceMalware, 30 Oct. Concept-level description only.
Powered by Thorsten Meyer AI
Who says what
Anthropic is a central party here, and this article was researched with help from Anthropic’s Claude. So this section quotes every party as published, without weighing in.
- Cursor (security notice, 29 Oct): “This malicious version of the extension was not developed by Anthropic. At most 5,000 users were affected, and we will reach out directly.” And: “We audited access and confirmed no other extensions were tampered with.” Cursor adds that it has “no evidence that other versions of the extension or the official distribution are affected.”
- Anthropic (Felix Rieseberg, member of technical staff, on X, 30 Oct, as quoted by The Register): “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users.” By the evening of 30 October we found no separate advisory on Anthropic’s news page, its status page or the Claude Code security advisories on GitHub.
- The Register reports that Anthropic made the statement after “prominent figures in the cybersecurity industry alleged” that the upload followed a breach at Anthropic.
- OpenSourceMalware: “The @anthropic-ai/claude-code NPM package is NOT malicious. The OpenVSX extension is NOT malicious. The Microsoft VSCode extension for Claude is NOT malicious.” It also cautions that its findings “do not, by themselves, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised.”
- The Hacker News argues that Cursor’s line that the build “was not developed by Anthropic” misses the point, because it was distributed under the legitimate extension ID rather than as a separate fake.
- Corrections: Some first reports said the bad build was on Open VSX, including an earlier version of The Hacker News story and Help Net Security’s story citing Phorion, which later added that this is disputed. OpenSourceMalware updated its post after Cursor told it the origin was Cursor’s marketplace. The Hacker News and BleepingComputer now say Cursor was the only source.
What nobody has explained: how the attacker got the ability to publish under Anthropic’s extension identity in Cursor’s store. According to The Register, apart from Rieseberg’s post, neither company has commented on that. Reuters reported that Anthropic did not immediately respond to a request for comment, and BleepingComputer said it had asked both companies.
Why this kind of attack works
Extension stores are app stores for your editor. Editors built on the open-source VS Code codebase cannot use Microsoft’s Visual Studio Marketplace under its terms of use, Help Net Security notes, so they rely on other registries. Cursor runs its own. Every store is one more place where a single bad upload reaches many machines.
The name tag is not a check. “Checking the publisher name doesn’t help when the publisher is real. What helps is watching behaviour: a coding extension planting SSH keys should be caught in seconds,” Ax Sharma, head of research at Manifold Security, told Help Net Security.
Auto-update multiplies. The same convenience that keeps tools patched delivered this build to whoever updated during those eleven hours.
Developer machines hold the keys. SSH keys, cloud tokens, source code. That is why attackers go after the tools developers use, as we described in Attackers Now Go After Your AI Tools.
It is not the first time this year. In May, GitHub said a poisoned VS Code extension was behind the theft of internal repositories, The Register reported. On 19 October, a hijacked contributor account swapped the downloads of five releases of OVHcloud’s official command-line tool for a secret-stealing build, The Hacker News reported. Same pattern each time: real name, real channel, wrong code.
Are you affected? How to check
Cursor’s advice applies if you “installed or updated to Anthropic.claude-code 2.1.313 from Cursor VS Code extension marketplace between 2:27am PT and 1:35pm PT on October 29, 2026.”
- Not affected, per the vendors and researchers: Claude Code in Microsoft’s VS Code from the Visual Studio Marketplace, the Open VSX version, and the npm package.
- The check: Cursor’s security notice gives a one-line command for macOS and one for Windows. Both look for a key labelled svc-telemetry in your SSH authorized-keys file. If it is there, the machine is affected. Take the commands and scripts only from that page.
- Linux: Cursor lists modified builds for macOS and Windows only, although the code contains a Linux branch. If you ran Cursor on Linux and updated in the window, compare against Cursor’s list of indicators and ask security@cursor.com, the address Cursor gives for questions.
If the key is there, these are Cursor’s steps, with additions from the researchers:
- Isolate the machine from the network.
- At work, save evidence first. OpenSourceMalware advises removing the extension and its startup entries “only after collecting evidence”.
- Run Cursor’s cleanup script for your platform. It removes the extension, the startup entries, running tunnel processes and the attacker’s key, and reports if anything remains. Cursor: “Uninstalling the extension may not be sufficient.” Installing a newer version does not clean up either, The Register notes.
- Decide whether to rebuild the machine. Cursor asks you to assess it; OpenSourceMalware calls a rebuild “safer than assuming removal of known artifacts restores trust.”
- Rotate credentials and sessions that were reachable from the machine, from a trusted system. That is Cursor’s wording. It gives no separate instruction for SSH keys; we read it as covering any keys and tokens stored on that machine.
- See whether anyone got in. Phorion suggests checking SSH logs for logins from localhost that used the svc-telemetry key.
If the check finds nothing, neither company asks you to rotate keys or change anything else for this incident.
Infographic 03 · Are you affected?
Three questions, one minute.
Cursor’s check and cleanup steps, with additions from the researchers. Neither company asks unaffected users to change anything.
- 1Did Claude Code install or update inside Cursor between 09:27 and 20:35 UTC on 29 October?From Cursor’s own extension store, version 2.1.313. Not sure? Run the check anyway.No: not affected, per Cursor and AnthropicYes or unsure: step 2
- 2Run Cursor’s one-line checkIt looks for a key labelled svc-telemetry in your SSH authorized-keys file. Use the command from Cursor’s security notice only.Not found: “machine not impacted” (Cursor)Found: step 3
- 3Key found: clean up properlyUninstalling or updating the extension is not enough.
If the key is there
- Isolate the machine from the network
- At work: tell IT and save evidence before cleaning
- Run Cursor’s cleanup script for macOS or Windows
- Decide whether to rebuild the machine
- Rotate credentials and sessions reachable from it, from a trusted computer
- Check SSH logs for logins from localhost with that key (Phorion)
Not affected, per vendors and researchers
- Claude Code in VS Code from Microsoft’s Visual Studio Marketplace
- The Open VSX version
- The npm package of Claude Code
- Other extensions in Cursor’s store (Cursor audited access)
Linux: Cursor lists macOS and Windows builds only. Questions: security@cursor.com.
A trusted name is not a security check.Thorsten Meyer · the takeaway
Sources: Cursor security notice, 29 Oct 2026; Felix Rieseberg (Anthropic) on X, 30 Oct; OpenSourceMalware, 30 Oct; Phorion, 30 Oct.
Powered by Thorsten Meyer AI
What this means for companies
- Know your editors and stores. Which editors run in your company, which marketplace each pulls from, which extensions are installed where. Without that list, “were we hit?” takes days instead of minutes.
- Control updates for powerful extensions. Allowlist approved extensions and use the update controls your editors and device management offer. An allowlist by publisher would not have stopped this build, because the publisher name was right. A short delay before updates reach everyone is our suggestion, not a vendor recommendation.
- Watch behaviour, not names. Alert when an editor process writes to SSH key files, creates startup items or opens outbound SSH tunnels. Phorion’s detection notes describe these signals; it also advises matching the key’s fingerprint, which Cursor publishes, and not only the label.
- Treat developer laptops as privileged. No local admin rights for daily work: that barrier is what stopped the worst step on most machines. Keep SSH remote login off unless it is needed. Prefer short-lived credentials over long-lived tokens in environment variables.
- Have the drill ready. Isolate, save evidence, clean, decide on a rebuild, rotate from a clean machine. Cursor’s notice is a usable template.
- Ask your vendors. How is publishing to their marketplace secured, how fast can they pull a version, and how do they tell customers? For deeper background on handing tools access, see AI Agents Now Hold Our Keys.
What this means for users
- Not using Cursor, or no Claude Code extension in Cursor? For this incident, both companies say you are not affected.
- Using Cursor with Claude Code? Run Cursor’s check today. It takes seconds.
- On a work machine? Tell your IT or security team before you clean up anything.
- Expect copycats. Cursor says it will contact affected users directly. Our advice: do not run scripts from emails or social posts that mention this incident. Go to cursor.com yourself and use the security notice there.
- Fewer extensions, fewer doors. Remove the ones you no longer use. Every extension is software that runs with your rights.
Honest limits
- 5,000 is an upper bound. Cursor says “at most”. How many machines actually ran the code, how many had SSH already on, and whether anyone logged in has not been published.
- The cause is unexplained. Anthropic says a malicious actor used access to Cursor’s marketplace; that is its statement. Cursor has not described how the build was published.
- Platforms: Cursor lists macOS (Apple silicon) and Windows builds. The code also contains a Linux branch; no Linux build has been listed.
- Sources with products: Phorion sells endpoint security software, and its write-up ends with a product pitch. Its core findings match Cursor’s notice and OpenSourceMalware’s separate analysis.
- No attribution. None of the sources names who is behind the attack.
- We did not analyse the code ourselves. The technical details come from Cursor, Phorion and OpenSourceMalware.
Verdict
The backdoor was buggy. The delivery worked. A real extension, a real store, an automatic update: that path reached up to 5,000 developer machines in eleven hours, and a coding bug did more to limit the damage than any name check. The lesson for companies and users is the same: a trusted name is not a security check. Watch what software does, and keep the rights you hand it small.
We will update this story if Cursor or Anthropic publish how the build got into the store. Related reading: Attackers Now Go After Your AI Tools, AI Has Taken the Clock Off Cyberattacks, and AI Agents Now Hold Our Keys.
Sources
- Cursor: Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace, 29 Oct 2026, and post on X, 30 Oct 2026, 07:46 UTC
- Felix Rieseberg (Anthropic): post on X, 30 Oct 2026, 14:08 UTC
- Anthropic: Claude Code releases on GitHub (v2.1.312, 27 Oct 2026; v2.1.314, 30 Oct 2026), checked 30 Oct 2026
- Phorion (Calum Hall): Official Claude Code Extension Compromise: Security Advisory, 30 Oct 2026
- OpenSourceMalware: Trojanized Claude Code Extension Plants an SSH Backdoor, updated 30 Oct 2026
- Reuters via CNA: Cursor says up to 5,000 users affected by tampered Claude Code extension, 30 Oct 2026
- The Register: Anthropic: That Claude Code extension compromise… couldn’t be us, 30 Oct 2026
- The Hacker News: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor, 30 Oct 2026
- BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors, 30 Oct 2026
- Help Net Security: Claude Code extension poisoned with persistent SSH backdoor, 30 Oct 2026 (updated)
- The Register: GitHub says internal repos exfiltrated after poisoned VS Code extension attack, 20 May 2026
- The Hacker News: Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware, 20 Oct 2026
Researched and drafted with AI assistance, including Anthropic’s Claude.
