New to this? Read it in simple words
- Cursor is an AI app for writing code, with a store for add-ons.
- For about 11 hours, its Claude Code add-on was a tampered copy.
- The copy tried to let an attacker into people’s computers.
- Anthropic says it did not make these versions, and Cursor has removed them.
- Extension
- An add-on that gives an app new features.
- SSH key
- A digital key that lets someone log in to a computer from far away.
- Backdoor
- A hidden way into a computer that gets around its normal security.
Cursor is a popular AI code editor built on Microsoft’s VS Code. It runs its own store for extensions, the add-ons that bring in tools such as Anthropic’s Claude Code. On October 29, two builds in that store were not what they claimed to be.
What the tampered builds did
Versions 2.1.312 and 2.1.313 of the Claude Code extension, for Windows and macOS, carried extra code, Cursor says. It added an SSH key named “svc-telemetry” to the computer, so that the attacker could log in later.
The code also tried to switch on remote login and open a hidden connection to the attacker’s server. Without administrator rights, those steps mostly failed, The Register and BleepingComputer report. The key, a way to start again after a reboot and the data sending still worked.
The code sent out the user name, the git email address, the public IP address and the names of settings that looked like secrets. It did not send the secret values themselves, according to Cursor and Phorion, a security company that analysed the code.
From Cursor’s notice and Phorion’s analysis. Times are Pacific time on October 29.
How long, and how many
The builds were in the store from about 2:27am to 1:35pm Pacific time on October 29, about 11 hours. Cursor’s notice, updated on October 30, names both versions; the first news reports named only 2.1.313.
BankInfoSecurity reports that Cursor put the number of affected users at no more than 5,000. Cursor’s own notice gives no number, and there is no public download count.
Cursor removed the builds, shut its whole extension store, changed its keys and rebuilt the store. It says it checked who had access and found no other tampered extensions.
Who is responsible
Anthropic says it did not build or publish these versions. “It wasn’t a compromise of Anthropic’s systems or employee laptops,” Anthropic’s Felix Rieseberg wrote on Hacker News.
Anthropic says a malicious actor used access to Cursor’s store. Cursor agrees that the builds were not made by Anthropic, but it has not said how the attacker got in. No suspect has been named.
Cursor says uninstalling the extension “may not be sufficient”, and it offers clean-up scripts for macOS and Windows. Users who had the bad builds should look for the “svc-telemetry” key, change their passwords and keys, and consider rebuilding the computer.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1Primary source · October 29, 2026, updated October 30Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace Cursor
- 2
- 3Primary source · October 30, 2026Comment on the Claude Code extension compromise Felix Rieseberg (Anthropic), on Hacker News
- 4Research · October 30, 2026Malicious Claude Code extension on Cursor planted SSH backdoors BleepingComputer
- 5Research · October 30, 2026Anthropic: That Claude Code extension compromise… couldn’t be us The Register
- 6Research · October 30, 2026Cursor Confirms Anthropic Claude Code Extension Compromised BankInfoSecurity
What the builds did comes from Cursor’s notice and Phorion’s analysis, and the news reports agree with them. The user count is Cursor’s figure as BankInfoSecurity reports it, and how the attacker got in is still unknown.
Tampered Claude Code add-on in Cursor’s store had a backdoor. Silicon AI News, October 31, 2026. https://siliconainews.com/stories/cursor-claude-code-extension-backdoor
A backdoored extension in Cursor’s store tried to give an attacker remote access to developers’ computers; Cursor pulled it after about 11 hours. How we rate the mood
The mood shows how the news frames the event for the tech and AI world: as an opportunity (6 and above) or as a loss (below 5). It is not our verdict on who is right.