TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Cursor says a modified Claude Code extension, version 2.1.313, was available in its extension marketplace for about 11 hours on October 29, potentially affecting up to 5,000 users. The build attempted to collect device information and establish persistent remote access. Cursor advises users to check for an SSH key labeled svc-telemetry and use its cleanup guidance if found.
Cursor says a tampered Claude Code extension was available in its marketplace for about 11 hours on October 29, potentially reaching up to 5,000 users. The modified version, numbered 2.1.313, used Anthropic’s extension name and identifier and attempted to collect information about users’ computers and set up remote access, according to Cursor and security researchers.
Cursor placed the exposure window at 09:27 to 20:35 UTC on October 29. The company said it removed the version after detecting it, blocked further distribution and temporarily shut down its VS Code extension marketplace while it audited access, rotated keys and rebuilt the marketplace. Cursor has not published a detailed timeline for those follow-up steps. Its estimate is that at most 5,000 users were affected.
Security researchers said the extension ran when the editor loaded it, without requiring a user to click a prompt. The code attempted to gather device details, add an SSH key labeled svc-telemetry, enable remote login, open a tunnel to an attacker-controlled server and persist after restarts. Cursor said enabling SSH required administrator rights and that this step failed on most Mac and Windows systems. The company also said the attacker’s server is now offline; those points do not establish that every other part of the attempted activity failed.
Cursor users who installed or updated Claude Code during the exposure window should check for the svc-telemetry SSH key. Cursor says finding it calls for its cleanup scripts; uninstalling the extension alone is not enough. Its guidance also recommends considering a rebuild of the machine and changing credentials from a separate, trusted computer.
Security Brief · Cursor Marketplace · October 29, 2026
The Update Looked Like Claude Code. Here’s What Cursor Users Can Check
A modified Claude Code extension appeared in Cursor’s marketplace for about 11 hours. Here is the reported scope, what the build attempted, and the system check Cursor recommends.
What the modified extension attempted
Researchers said the build ran when the editor loaded it. The described actions are attempts; public reporting does not confirm successful access or data theft.
Collect device details
Attempted to gather information about the user’s computer.
Add an SSH key
Attempted to install a key labeled svc-telemetry.
Open remote access
Attempted to enable remote login and create a tunnel to an attacker-controlled server.
Persist after restart
Attempted to leave access in place across system restarts.
A short window, with an unconfirmed install count
Cursor estimated a maximum potential reach. It has not published how many people installed or loaded the version.
Cursor said it removed the version, blocked further distribution, and temporarily shut down its VS Code extension marketplace while auditing access, rotating keys, and rebuilding the marketplace.
What is known
Version and channel
The modified 2.1.313 build was listed in Cursor’s marketplace under Anthropic’s extension name and identifier.
What remains unclear
How it was published
Neither company has publicly explained the access path used to publish the altered build under that identity.
Important distinction
Other channels
The incident reporting identifies Cursor’s marketplace. Microsoft Visual Studio Marketplace, Open VSX, and npm were not identified as affected.
If you used Claude Code in Cursor during the window
Follow Cursor’s published incident guidance and check for the named SSH key. Removing the extension alone is not the recommended cleanup.
Recommended response
- Check the system for an SSH key labeled svc-telemetry.
- If it is present, use Cursor’s cleanup scripts and guidance.
- Consider rebuilding the machine, especially if it held sensitive credentials.
- Change credentials from a separate, trusted computer.
What the public account confirms—and what it does not
Keep the distinction between an attempted action, a potential exposure, and confirmed compromise.
| Question | Reported answer | Status |
|---|---|---|
| Which build? | Modified version 2.1.313 in Cursor’s VS Code extension marketplace. | Reported |
| How many users? | Potentially up to 5,000; actual installs or loads have not been disclosed. | Upper bound |
| Was access successful? | The build attempted remote access; successful access is not confirmed in available reporting. | Unconfirmed |
| Was data stolen? | Collection was attempted; reporting does not confirm data reached the attacker. | Unconfirmed |
| Was Anthropic compromised? | Anthropic technical staff said its systems and employee laptops were not compromised. | Statement made |
Quick answers for Cursor users
The reported scope may change as Cursor and Anthropic publish more details.
Could auto-update have delivered it?
Yes. Researchers said users with Claude Code set to auto-update could have received the modified build through the existing listing.
Was Open VSX the source?
No. Early reports naming Open VSX were corrected; the identified distribution channel was Cursor’s marketplace.
Did every affected machine enable SSH?
That is not established. Cursor said the administrator-rights step failed on most Mac and Windows systems.
What is still unknown?
How the listing was altered, how many users loaded it, whether remote access succeeded, and whether collected data reached the attacker.
How an Extension Update Reached Users
The incident shows how a compromised software distribution channel can put a malicious build under the name and identifier users already trust. Because the modified extension was delivered as an update to the existing listing, users with automatic updates may have received it without deliberately installing a new extension. OpenSourceMalware co-founder Jenn Gile told The Hacker News that users with Claude Code set to auto-update could have consumed the malware.
For affected developers, the attempted access matters because editor extensions can run within a working environment that contains source code, project files and credentials. The available material describes what the build tried to do, but does not establish that attackers successfully accessed those assets. Cursor’s estimate is an upper bound on users affected, not a confirmed count of machines where remote access succeeded.
Products Worth Considering
Bose SoundLink Flex (2nd Gen) Portable Bluetooth Speaker
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Apple Watch SE 3 GPS 44mm Smartwatch
As an affiliate, we earn on qualifying purchases.
The Confirmed Distribution Window
Anthropic’s public GitHub release list showed version 2.1.312 on October 27, followed by 2.1.314 on October 30; it did not list an official 2.1.313 release when checked on October 30. The tampered 2.1.313 was available through Cursor’s VS Code extension marketplace, according to Cursor and researchers who examined the build.
Early reports naming Open VSX as the distribution source were corrected. The source material says security researchers found that the affected listing was in Cursor’s marketplace, not Open VSX, Microsoft’s Visual Studio Marketplace or the npm package. This distinction matters because using Claude Code through those other channels is not identified as affected by this incident.
Cursor’s account says the marketplace was taken offline as a precaution, then audited and rebuilt. Anthropic’s technical staff member Felix Rieseberg said on October 30 that the incident was not a compromise of Anthropic’s systems or employee laptops. That statement addresses Anthropic’s internal systems; it does not explain how a modified package appeared under Anthropic’s identity in Cursor’s store.
“Anyone who has their Claude Code instance set to auto-update could have consumed the malware.”
— Jenn Gile, co-founder of OpenSourceMalware, speaking to The Hacker News
How the Listing Was Compromised
Neither company has publicly explained how the modified build was published under Anthropic’s extension identity in Cursor’s store. Anthropic said a malicious actor “used access to Cursor’s marketplace,” while Cursor has not described the access path. The public record also does not establish who first detected the incident: Cursor says it identified it, while reports credit security researchers and a developer alert.
It remains unclear how many users actually installed or loaded the build, whether any attacker successfully used the attempted remote-access mechanism, and whether data collected by the extension reached the attacker. Cursor’s estimate of up to 5,000 users does not answer those questions. The statement that SSH activation failed on most Mac and Windows systems likewise does not show what happened on every affected device.
Checks for Cursor Claude Code Users
Users who had Claude Code installed in Cursor should follow Cursor’s published incident guidance and check their systems for the svc-telemetry SSH key. If it is present, Cursor says to use its cleanup scripts rather than relying on uninstalling the extension. Users should consider rebuilding the machine and change credentials from a separate, trusted computer, especially where the device contained sensitive access tokens or project credentials.
Cursor and Anthropic may provide further details about the marketplace access and the investigation. Until then, users should treat the reported exposure window and affected distribution channel as the scope currently described by the companies and researchers, and check official vendor updates for any changes.
Key Questions
Which Claude Code version was affected?
The modified extension was version 2.1.313 in Cursor’s VS Code extension marketplace. Anthropic’s public GitHub release list did not include an official 2.1.313 release when checked on October 30.
Who may have received the modified extension?
Cursor said the version was available from 09:27 to 20:35 UTC on October 29 and may have affected at most 5,000 users. The company has not said how many users actually installed or loaded it.
What should Cursor users check?
Check for an SSH key labeled svc-telemetry and follow Cursor’s incident guidance. If the key is present, Cursor says uninstalling the extension alone is insufficient; use its cleanup scripts and consider rebuilding the machine.
Were other Claude Code distribution channels affected?
The source material identifies the incident in Cursor’s marketplace and says the Microsoft Visual Studio Marketplace, Open VSX and npm package were not affected. Early reports naming Open VSX were corrected.
Did attackers gain access to users’ computers or data?
The extension attempted to establish remote access and collect device information, but the available reporting does not confirm successful access or data theft. Cursor said SSH activation failed on most Mac and Windows systems and that the attacker’s server is now offline.
Source: Thorsten Meyer AI
