![Tampered Claude Code Extension Hit 5,000 Users [2026]](https://shattered.io/wp-content/uploads/2026/10/cursor-tampered-claude-code-extension-5000-users-2026-gen.webp)
Cursor told customers on October 29, 2026 that a tampered Claude Code extension reached its extension marketplace and that up to 5,000 users were affected, according to TimesLive. The modified build carried the name Anthropic.claude-code and the version number 2.1.313. Cursor says Anthropic did not write it.
For developers, the story lands close to home. The Claude Code extension sits inside the editor, near source code, terminals, API keys and SSH configuration. If a poisoned build runs there, the attacker starts with a seat at the desk. Cursor’s fix path is simple (update to version 2.1.314), but the checks that follow are not.
This article sorts the confirmed facts from the open questions, walks through the timeline, shows how to check a machine, and looks at what the incident means for AI coding tools. It also connects to our earlier coverage of Claude Code 2.1.311, which shows how fast this tool’s release train moves.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What Cursor Confirmed About the Tampered Claude Code Extension #
Cursor’s public statement is short and specific. The company said it identified a security incident involving a modified Claude Code VS Code extension that users could reach through the Cursor IDE extension marketplace. It capped the impact at 5,000 users. It also said the malicious version was not an Anthropic product.
The Hacker News reproduced the core of that statement. In Cursor’s words: “We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.” The outlet’s headline describes the extension as trojanized with a persistent SSH backdoor.
Cursor drew a hard line on authorship in a second sentence of its notice. Its statement reads, “This malicious version of the extension was not developed by Anthropic.” That wording matters because the listing used the Anthropic.claude-code identifier, the same name a developer would trust on sight.
Here are the details Cursor and the reporting outlets put on the record:
- The extension identifier was
Anthropic.claude-code, and the bad build was version2.1.313. - The affected channel was the Cursor extension marketplace.
- Cursor counted at most 5,000 affected users.
- The exposure ran from roughly 2:27 a.m. PT to 1:35 p.m. PT on October 29, 2026.
- The modified extension tried to install a backdoor, collect basics such as IP addresses, usernames and operating systems, and add an attacker-controlled SSH key.
- Cursor asked customers to move to Claude Code for VS Code version 2.1.314.
Notice what the list leaves out. Cursor did not publish an exact count below the 5,000 ceiling, and no source in our file confirms how many installs actually ran the payload. We return to that gap below.
The 11-Hour Exposure Window, in Numbers #
Cursor gave a window rather than a single timestamp. From 2:27 a.m. to 1:35 p.m. Pacific Time is 11 hours and 8 minutes. In UTC, with Pacific Daylight Time still in effect on October 29, that runs from about 09:27 to 20:35. A European developer working through the afternoon and a US developer starting early could both have pulled the update.
A quick piece of arithmetic frames the scale. If all 5,000 users installed during the window, the average would be about 450 installs per hour. That figure is a ceiling built from Cursor’s own cap, not a measured rate, because the real count was lower or equal and the installs were unlikely to arrive evenly. Treat it as a sense of magnitude, nothing more.
| Item | Detail | Basis |
|---|---|---|
| Extension ID | Anthropic.claude-code | Cursor statement |
| Tampered version | 2.1.313 | Cursor statement |
| Fixed version | 2.1.314 | Cursor guidance to customers |
| Exposure start | About 2:27 a.m. PT, Oct. 29, 2026 | Cursor statement |
| Exposure end | About 1:35 p.m. PT, Oct. 29, 2026 | Cursor statement |
| Window length | 11 hours, 8 minutes | Calculated from the two times |
| Maximum affected users | 5,000 | Cursor statement |
| Average installs per hour, if all 5,000 hit | About 450 | Calculated ceiling, not measured |
The table shows why the incident counts as contained but not trivial. Eleven hours is short by the standards of long-running supply chain compromises. It is also long enough for an automatic extension update to fire on thousands of machines overnight, since many editors check for updates in the background.
How a Marketplace Listing Became a Backdoor Path #
An editor extension runs with the same permissions as the user who launched the editor. It can read files in open workspaces, spawn processes and touch the home directory. That is the whole point of a coding assistant, and it is also why a modified build is dangerous. The attacker does not need an exploit when the install button grants access.
Cursor and the outlets covering it describe a three-part goal for the modified code. It tried to install a backdoor, to gather host details and to plant an SSH key the attacker controls. Each part serves a different stage of an intrusion.
What the payload tried to do
Collecting IP addresses, usernames and operating systems is reconnaissance. It tells an operator which machines are worth a second look. A laptop on a corporate VPN with a developer username and a Linux build differs from a throwaway virtual machine, and the attacker wants to know the difference before spending effort.
The pasqualepillitteri.it write-up frames the incident around the same behavior, with a headline that says the extension tries to open an SSH backdoor. Other reports say the malicious code installed persistence that could keep running after removal, which is why simple uninstalling is not a clean answer. We could not tie that claim to a single verified primary document, so read it as reported guidance and act on it cautiously.
Why the SSH key is the scariest part
An attacker-controlled public key in an authorized keys file is a quiet door. Once it sits there, the attacker can log in over SSH without a password and without the extension running at all. That makes removal of the extension necessary but not sufficient, and it explains why responders talk about inspecting the SSH configuration rather than just reinstalling software.
The door only opens if the machine accepts SSH logins and is reachable by the attacker. A laptop behind a home router with no SSH service exposed has less risk than a cloud development box. Still, developers often forward ports, run tunnels or sit on flat office networks. Do not assume safety from the network alone. Good key hygiene helps here, and our walkthrough on how to generate an Ed25519 SSH key covers the fresh-key side of a cleanup.
What Is Confirmed and What Is Not #
Breaking security stories attract loose numbers. Within hours, headlines will round 5,000 up to thousands of hacked machines and treat an attempted action as a completed one. The record is narrower, and readers deserve the distinction.
| Claim | Status | Note |
|---|---|---|
| Version 2.1.313 was malicious | Confirmed | Cursor statement |
| Anthropic did not develop it | Confirmed | Cursor statement |
| At most 5,000 users affected | Confirmed as a ceiling | Cursor statement |
| Extension attempted a backdoor, data collection and an SSH key | Confirmed as attempted behavior | Cursor statement and reports |
| Update to 2.1.314 recommended | Confirmed | Cursor guidance |
| Exact number of users below 5,000 | Unconfirmed | No figure published |
| Every affected install led to unauthorized access or data theft | Unconfirmed | Attempt is not the same as success |
The last two rows deserve emphasis. “At most 5,000” is a ceiling on exposure. It does not say that 5,000 machines were compromised. It also does not say the number is close to 5,000, since Cursor has not narrowed it. A reader should neither shrug at the cap nor read it as a body count.
Anthropic’s Role: A Name on the Listing, Not the Author #
The most confusing part of this story is naming. The tampered build carried Anthropic’s extension ID, yet Cursor says the company did not write it. Both statements can be true because a marketplace listing is just a record that points at a file. If the wrong file sits behind a trusted name, users see the trusted name.
Cursor’s own wording keeps responsibility for the distribution channel with the marketplace, which it calls “our Cursor IDE extension marketplace.” It does not describe a compromise of Anthropic’s build systems. Our verified sources do not say how the modified file reached the listing, and Cursor has not published that detail in the material we reviewed. Until it does, speculation about the entry point is just that.
For Anthropic, the reputational angle is awkward even when the fault lies elsewhere. Users associate the extension with the company, and a headline about a trojanized Claude Code extension travels without the footnote. Our Codex vs Claude Code usage comparison shows why this tool is a high-value target, since developer share translates to attacker interest.
Cursor’s Response: Marketplace Down, Then Back Up #
Cursor acted on the marketplace itself. In a statement carried by a pasqualepillitteri.it report, the company said: “In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.”
India Today headlines the story as Cursor shutting down the marketplace after the extension hit 5,000 users and offered a fix. That matches the sequence above. The removal of the bad version came first, a temporary shutdown followed, and the marketplace returned once Cursor judged the risk gone.
Cursor also hosts a macOS remediation script at cursor.com. Read any remediation script before you run it, especially one tied to a supply chain incident. Open it in a text editor, check what it deletes or changes, and confirm the domain in the address bar. Running unreviewed code to clean up unreviewed code is the same mistake twice.
The response looks fast on paper. The window closed at about 1:35 p.m. PT, and Cursor communicated the same day. But speed after detection is only half the measure. The open question is how long the modified build sat in the marketplace before anyone noticed, and whether the first alert came from users, security researchers or Cursor’s own monitoring. That detail shapes how much trust the marketplace should earn back.
How to Check Whether Your Machine Was Hit #
Start with version. Anyone who installed or auto-updated the Claude Code extension in Cursor on October 29, especially during the overnight and morning Pacific hours, should check which build ran. Version 2.1.313 is the one to look for. Version 2.1.314 is the one Cursor wants installed.
The commands below are general triage steps from our team, not Cursor’s published procedure. They help you look for the behaviors Cursor described. Adjust paths for your setup.
cursor --list-extensions --show-versions | grep -i claude-code
cat ~/.ssh/authorized_keys
Get-Content $env:USERPROFILE\.ssh\authorized_keys
last -n 20
Any line in authorized_keys that you did not add yourself deserves a closer look. Do not delete it blindly on a machine you suspect, since the key and its timestamp are evidence. Copy the file first, then remove the unknown entry once you have a record.
Reports quote Cursor’s advice to review endpoint, network and extension-install telemetry and to isolate hosts that show signs of payload execution. That advice suits managed fleets. Individual developers can mirror it by checking router or firewall logs for unexpected inbound SSH, scanning shell history, and rotating credentials that lived on the machine. Think API keys, cloud tokens, Git credentials and any private keys stored in the home directory.
One practical point on credentials: if the machine held anything valuable, rotate first and investigate second. A rotated token is useless to an attacker even if the backdoor ran.
Why AI Coding Extensions Make Attractive Targets #
An AI coding extension differs from a color theme or a linter. It reads large parts of a codebase, calls external services, runs commands on the user’s behalf and often holds authentication tokens. The more autonomy the tool has, the more a poisoned copy can do without raising an alarm.
Autonomy is also a design goal. Vendors push agents that edit files, run tests and open pull requests. Users grant broad permissions to save time. That trade-off puts a premium on knowing exactly which code is running, a theme we covered in our piece on zero trust for AI agents after login. Login is the first checkpoint. What the agent does after login is the second.
Cursor sits at the center of this shift, as an editor built around AI features and extensions. Teams that script it, as in our Cursor SDK review-agent tutorial, tie more automation to the same environment. A compromised extension in that setting inherits access to automated workflows, not just a single developer’s files.
Historical Context: From event-stream to xz #
Software supply chain attacks are not new. The 2018 event-stream incident showed that a popular npm package could change hands and then ship hidden code. The 2020 SolarWinds compromise showed that a trusted update channel could deliver malware to thousands of organizations. The 2024 xz Utils backdoor showed that a patient attacker could target a small open source project with big reach.
What changes in 2026 is the target. Package registries and build systems still matter, but the editor itself now carries agents with file access and network access. An extension marketplace holds the same trust relationship as a package registry, only closer to the human. A developer might skim a dependency tree. Few people audit an extension that bears the name of a leading AI lab.
The pattern across these cases is consistent. Attackers go where trust is automatic. Defenders respond with signing, pinning, review and monitoring, and those controls tend to arrive after the first big incident rather than before it. The Cursor event follows that script, at smaller scale than SolarWinds and with a much shorter exposure window.
Competitive Comparison: How Extension Trust Models Differ #
No two AI coding setups share the same trust model. The table below compares general approaches rather than specific products, because our verified sources describe only the Cursor marketplace channel. It shows where an incident like this one can enter and which controls blunt it.
| Install approach | Who controls the file | Exposure to a swapped build | Main control |
|---|---|---|---|
| Public marketplace, auto-update on | Marketplace operator | Highest, new versions land without review | Disable auto-update, review changelogs |
| Public marketplace, pinned version | Marketplace operator | Medium, a bad pinned build still runs | Pin only after checking publisher and hash |
| Internal mirror with allowlist | Your security team | Lower, nothing ships without approval | Approve extension IDs and versions |
| Vendor CLI outside the editor | Vendor distribution channel | Separate path, different risks | Verify signatures and release notes |
The first row describes the situation most individual developers live in. Auto-update is convenient, and in this case it magnified the exposure. The third row costs effort but shrinks the blast radius. If your team runs several AI assistants, our team pilot guide for AI coding assistants includes a step for deciding which tools get access to which repositories, and this incident gives that step more weight.
Market Impact for Cursor, Anthropic and Rivals #
No public price tag attaches to this incident. Neither company reported financial impact in the material we reviewed, and we are not aware of a published loss estimate. Anyone quoting a dollar figure at this stage is guessing.
The more useful measure is trust. Cursor competes on how much developers will let its AI features touch. A marketplace compromise, even a short one, invites enterprise security teams to ask for tighter controls before approving the product. Expect questionnaires, requests for audit logs and demands for allowlisting features. Those asks slow sales cycles in regulated industries, though they rarely end them.
Anthropic carries a quieter risk. The company did not write the malicious build, but customers who see its name in the headline may rollouts of Claude Code while they review. Rival tools face a cautionary lesson rather than a windfall. Any assistant distributed as an editor extension shares the same attack surface, so competitors have little room to gloat.
For the wider AI sector, the story reinforces a theme we track in the AI and machine learning section. Model quality headlines get the attention, but distribution and trust determine who ships safely at scale.
Five Predictions for AI Extension Security #
These are our analysis, not reported facts. Each rests on the pattern of earlier supply chain incidents and on the details Cursor has disclosed so far.
- Cursor will publish a fuller post-incident account. The entry point is the biggest unanswered question, and enterprise customers will press for it.
- Enterprises will move toward allowlists. Teams that let developers install anything from a marketplace will reconsider, and managed extension lists will become a standard procurement ask.
- Verified publisher checks will get louder. Marketplaces will highlight publisher identity and build provenance, because a familiar name alone proved insufficient here.
- Attackers will copy the playbook. A trusted AI brand name on a modified extension worked well enough to make headlines. Expect imitators across editors and registries.
- Extension telemetry will join the security stack. Endpoint teams already watch processes. They will add extension installs and version changes to the signals they collect.
Prediction one is the easiest to test. If Cursor publishes a root-cause note within weeks, it will confirm that customers pushed for detail. If it stays quiet, the other four predictions gain strength, because the market will fill the vacuum with its own controls.
What Teams Should Do This Week #
Security leads can turn the incident into a short action list. Most items take an hour or less.
- Ask every developer to confirm their Claude Code extension version, and move anyone on 2.1.313 to 2.1.314 after the checks above.
- Pull extension install logs for October 29, with focus on the overnight and morning Pacific window.
- Review SSH authorized keys on developer laptops and any shared dev servers.
- Rotate tokens and keys stored on machines that ran the bad build.
- Switch off extension auto-update for high-risk teams until your policy catches up.
- Decide who owns extension approval going forward, and write it down.
Individual developers can skip the policy items and do the first four. If any step turns up an unfamiliar key or a suspicious login, treat the machine as compromised, disconnect it from the network and rebuild it from a clean image. A rebuild is slower than a cleanup but it removes doubt.
Frequently Asked Questions #
Did Anthropic build the malicious Claude Code extension?
No. Cursor stated that the malicious version of the extension was not developed by Anthropic. The build used the Anthropic.claude-code identifier on the Cursor marketplace, but the company says the file itself did not come from Anthropic.
How many users did the tampered Claude Code extension affect?
Cursor said at most 5,000 users were affected. That is a ceiling. The company has not published an exact number below it, and it has not said that every affected install led to unauthorized access.
Which version is dangerous and which is the fix?
Version 2.1.313 of the Claude Code VS Code extension is the tampered build. Cursor asked customers to update to version 2.1.314.
When was the extension exposed?
The window ran from about 2:27 a.m. PT to 1:35 p.m. PT on October 29, 2026, which is roughly 11 hours and 8 minutes. If you installed or updated during that period, check your version.
Does updating to 2.1.314 fully clean my machine?
Not necessarily. Reports of Cursor’s guidance say the malicious code could leave persistence behind, and the modified extension tried to add an attacker-controlled SSH key. Update, then inspect your SSH authorized keys, review logs and rotate credentials if you ran the bad build.
Is the Cursor marketplace safe to use now?
Cursor says it reinstated the marketplace after confirming there was no further risk. That is the company’s assessment. Cautious teams can add their own controls, such as allowlists and disabled auto-update, while waiting for a fuller post-incident report.
Should I stop using AI coding extensions?
Nothing in the reporting suggests that. The lesson is to control how extensions arrive and update, not to abandon them. Verify versions, limit permissions where the tool allows it, and keep credentials out of reach of editor processes when you can.