Tampered Claude Code reached 5,000 Cursor users in two builds

Cursor has narrowed the October 29 marketplace incident to two builds of Anthropic’s Claude Code extension, and to a smaller crowd than a vague “low thousands.” The company says versions 2.1.312 and 2.1.313, shipped through its own marketplace for Windows and macOS, were the tampered releases. It puts the number of people who installed a bad build at 5,000 at most, between about 2:27 a.m. and 1:35 p.m. Pacific Time that day. An earlier notice had named only 2.1.313.

Anthropic’s account, given after the first wave of reporting, is that this was not a breach of Anthropic. Security engineer David Dworken said a malicious actor used access to Cursor’s marketplace to publish a tampered package that stayed up for close to 12 hours. Engineering manager Felix Rieseberg said Anthropic is working with Cursor, and that Anthropic’s systems and employee laptops were not the source. The copies on Microsoft’s Visual Studio Marketplace, Open VSX, and the npm package are the ones Anthropic actually publishes. Those channels are not known to have carried the bad builds. The current good release named on the official registries is 2.1.314.

That split is the fact a security team can use. A developer who installed Claude Code from Microsoft’s store or from Open VSX is in a different bucket from a developer whose Cursor install pulls extensions from Cursor’s marketplace and updates them on its own. Cursor says it rotated keys, rebuilt the marketplace, and worked with the cloud provider so the attacker’s server is offline. Socket’s review, cited in the same reporting, found no sign that 2.1.313 was published on Open VSX. Microsoft said the malicious build was never on its marketplace and never in the anthropic-ai/claude-code npm package.

The extension can be gone and the mess still there

The public descriptions agree on the intent: the tampered extension tried to leave a persistent SSH foothold and to report basic facts about the machine. They also agree on a limit. Turning on the local SSH service needs administrator rights the extension does not have on most Macs and Windows PCs, so a working remote login often never happened. The failure of that step is not a clean bill of health. Cursor says the extension can still add an SSH key, set up persistence, and send host details even when the login path fails.

Microsoft’s research team made the operational point that matters after the package is deleted. Removing or updating the extension does not remove files it wrote outside its own folder. Unauthorized keys, tunnel identities, scripts, and startup entries have to be cleared on their own. Treat “we updated Claude Code” as the start of the check, not the end.

This desk will not describe the loader, the key material, the server, or the steps that made the foothold. Those details are for the vendor notices and for the people doing the host review.

What to do with a Cursor fleet

List machines that could have auto-updated Claude Code from Cursor’s marketplace on October 29. The builds to hunt are 2.1.312 and 2.1.313. Isolate those hosts before you tidy them. Then remove the bad extension, and separately remove any SSH key, startup entry, or helper the review confirms was not yours. Rotate source-control tokens, cloud keys, and session cookies that lived on those laptops. An SSH key left behind is a quieter problem than a live tunnel, and it outlasts the extension that wrote it.

For everyone else, pin Claude Code to a known-good build and stop silent marketplace updates on coding extensions until someone approves the version. Official publisher was not the control that held. The marketplace that served the update was.

This briefing relies on public reporting by The Hacker News.