The Update Used The Claude Code Name—Here’s What Cursor Users Can Check

🔍 Read the full analysis: The Update Used The Claude Code Name—Here’s What Cursor Users Can Check on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Cursor says a tampered Anthropic Claude Code extension was available in its extension marketplace for about 11 hours on October 29, and that up to 5,000 users may have received it. The modified version, numbered 2.1.313, used the official extension name and identifier but was not built by Anthropic; Cursor says it removed the release and will contact affected users.

According to Cursor’s incident notice, version 2.1.313 was available from 2:27 a.m. to 1:35 p.m. Pacific time on October 29. The company says it identified the issue, removed the version, blocked further distribution and temporarily shut down its VS Code extension marketplace. Cursor said it audited access, rotated keys, rebuilt the marketplace and restored it. It has not published a detailed account of how the altered package was accepted under Anthropic’s extension identity.

Security analyses from Phorion and OpenSourceMalware describe a small loader placed before the extension’s regular code. It ran when the extension loaded, without a separate click, and attempted to collect computer information, add an attacker-controlled SSH key, enable remote login, open a connection to an outside server and remain active after restarts. Researchers reported that the extension’s identity matched the legitimate listing, making the incident different from a copycat extension with a slightly altered name.

Cursor says enabling SSH required administrator privileges and that this step failed on most Mac and Windows computers. That may have limited remote access, but it does not establish that every other action failed. The researchers and vendor materials describe the key addition and data reporting as part of the attempted activity. Cursor says the attacker’s server is now offline. It advises users of Claude Code in Cursor to check for a key labelled svc-telemetry; if present, users should not rely on uninstalling the extension alone.

Why Cursor Users Should Check SSH

The incident matters because the compromised software arrived through Cursor’s extension marketplace under the name and identifier users would expect for Anthropic’s tool. Users with automatic extension updates could have received the altered version without deliberately installing a new listing. The episode shows that a familiar publisher label or extension ID does not, by itself, establish that a particular package was built by that publisher.

For developers, the potential exposure reaches beyond the editor. Extensions can operate with the permissions available to the user, and developer computers may contain source code, local files and credentials. Cursor’s account that the SSH step failed on most systems narrows one reported route for access, but it does not answer whether information was collected or whether users’ other credentials were exposed. The practical response is to check the specific indicators and follow the vendor’s remediation instructions rather than assume that removing the extension resolves all risk.

The stated figure of up to 5,000 users is Cursor’s estimate of potential impact, not a confirmed count of machines compromised or accounts accessed. That distinction matters: the number describes the possible audience for the bad release, while the extent of any successful intrusion remains unreported.

Popular right now

Bose QuietComfort Headphones (2nd Gen), Wireless Noise-Cancelling Over-Ear Headphones, Black

AmazonView Latest Price

Dyson Car+Boat Cordless Handheld Vacuum

AmazonView Latest Price

Ninja Foodi 10-Qt DualZone Smart XL Air Fryer, 6-in-1, DZ550

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How Version 2.1.313 Reached Cursor

The incident concerned Cursor’s VS Code extension marketplace, not all ways of installing Claude Code. The source material says the altered package was not present in the Microsoft Visual Studio Marketplace, Open VSX or Anthropic’s npm package. Early reports naming Open VSX were corrected. These distinctions are important for users who obtained the tool through a different distribution channel, though people should still follow relevant security notices for their own installation.

Anthropic’s public release history went from version 2.1.312 to 2.1.314, with no official 2.1.313 release listed. Anthropic published 2.1.312 on October 27 and released 2.1.314 on October 30, according to the supplied timeline. Cursor’s marketplace window for the modified version began early on October 29 and ended at 1:35 p.m. Pacific time that day.

Cursor said it removed the package and took its marketplace offline as a precaution while it reviewed access and rebuilt the service. Anthropic said its own systems and employee laptops were not compromised. Those statements address different parts of the incident: the affected distribution channel was Cursor’s marketplace, while the route by which the package was published there has not been publicly explained.

“The modified extension was impacting at most 5,000 users.”

— Cursor

How the Package Passed Marketplace Checks

The central unanswered question is how someone published the altered build under Anthropic’s extension identity. Cursor has not publicly explained the publishing path or identified the person or account responsible. Anthropic said a malicious actor “used access to Cursor’s marketplace,” but that statement does not specify how the access was obtained or whether a particular account or process was abused.

It is also not clear how many users actually installed or loaded version 2.1.313, whether any user’s system was successfully accessed, or what information—if any—was taken. Cursor’s estimate is “at most 5,000” potentially affected users; the supplied information does not give a verified number of successful installations or compromised computers. The failed SSH-enabling step on most Macs and Windows PCs is not proof that all other attempted actions failed.

The source material says the attacker’s server is offline, but does not establish whether all copies of the added key, startup entries or reported data were removed from affected machines. Users should rely on Cursor’s current incident guidance for cleanup rather than infer that marketplace removal or extension uninstallation fully repairs a system.

User Checks and Cursor’s Follow-Up

Cursor says it will contact users it identifies as affected. Users who installed or updated Claude Code through Cursor during the incident window should check Cursor’s security notice and run the company’s recommended check for an SSH key labelled svc-telemetry. If the key is present, Cursor’s guidance calls for cleanup scripts; the supplied material also recommends considering a rebuild of the computer and changing credentials from a separate, trusted device.

Uninstalling the extension alone may not remove changes made elsewhere on the system. Anyone who finds the key or other indicators should preserve relevant information where appropriate and follow Cursor’s published remediation instructions. The supplied source does not include the full scripts or their exact commands, so users should obtain them directly from Cursor rather than use instructions from an unverified copy.

The next public developments to watch are Cursor’s account of how the package entered its marketplace, any updated estimate of affected installations, and further guidance on cleanup. Anthropic’s release history lists version 2.1.314 after the incident. That later release does not, on its own, determine whether a particular Cursor installation was exposed or cleaned.

Key Questions

What happened to the Claude Code extension in Cursor?

A modified version 2.1.313 appeared in Cursor’s marketplace on October 29 for about 11 hours. Cursor says it was not built by Anthropic and that it could have reached up to 5,000 users.

How can a Cursor user check for the reported indicator?

Cursor’s guidance is to check for an SSH key labelled svc-telemetry and use the company’s incident instructions if it is present. Get any cleanup scripts directly from Cursor.

Is uninstalling Claude Code enough?

Not necessarily. The reported activity included changes beyond the extension itself. Cursor’s guidance calls for cleanup if the key is found; the source material also advises considering a system rebuild and changing credentials from a separate, trusted computer.

Were all Claude Code installations affected?

No such finding is reported. The incident was in Cursor’s VS Code extension marketplace. The source material says the Microsoft Visual Studio Marketplace, Open VSX and Anthropic’s npm package were not affected by this incident.

Does Cursor know how the malicious version was published?

That remains unclear publicly. Cursor has not explained how the altered build appeared under Anthropic’s extension identity. Anthropic said a malicious actor used access to Cursor’s marketplace, without publicly describing how that access was obtained.

Source: ThorstenMeyerAI.com