Cursor says two tampered builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, were distributed through its own extension marketplace to macOS and Windows users on 29 October 2026. Cursor says Anthropic did not build them, and it has no evidence that the official distribution or other versions were affected.
So this is a narrow incident, not a case of “all Claude Code is compromised.” If you did not install those versions from Cursor’s marketplace, the notices do not describe you.
The short answer
- Which packages: Anthropic.claude-code 2.1.312 and 2.1.313, per Cursor.
- Which source: Cursor’s extension marketplace only. Cursor says the official distribution shows no sign of impact.
- Which platforms: macOS and Windows, per Cursor.
- What the code tried to do: Phorion reports it tries to install persistent SSH access and collect machine information, mainly on macOS.
- Uninstalling may not be enough: Cursor warns the payload can leave scripts that keep running after the extension is removed.
What is the timeline?
| Date (2026) | Who | What happened |
|---|---|---|
| 29 October | Cursor | Incident. Cursor puts the distribution window at about 2:27 am to 1:35 pm Pacific. It removed the packages and published its notice. |
| 30 October | Phorion | Published a technical analysis. At that point it named version 2.1.313. |
| 31 October | Phorion | Updated the analysis to add 2.1.312, citing Cursor’s notice. Both versions are now covered. |
Cursor also says it revised its own notice on 30 October to clarify the affected versions.
Are you affected? Check these three things
- Name: Do you use the Claude Code extension, published as Anthropic.claude-code?
- Source: Did you install or update it from Cursor’s extension marketplace? Cursor says the official distribution shows no evidence of impact.
- Version and platform: Is it version 2.1.312 or 2.1.313, on macOS or Windows, installed or updated during the window above?
Three yes answers mean you should act. Any no means the notices do not describe your setup.
What do Cursor and Phorion say happened?
Cursor says the packages were a maliciously modified build, not developed by Anthropic. It removed them, shut down and rebuilt the marketplace, rotated its keys, and audited access. It reports no other extensions were tampered with. It also says the attacker’s server no longer functions, so the contact point the code used has stopped working.
Cursor also says the code tried to add an unauthorized SSH key, set up a reverse tunnel, and report host details. It adds that the tunnel step would fail in most cases because of errors in the code, unless Cursor ran with administrator privileges. The persistence attempts, it says, are present even with the server offline.
Phorion reports the code runs when the extension loads. It tries to prepare SSH access, keep a tunnel alive, and send a one-time report of machine information. Phorion focuses mainly on macOS and says implementation bugs limit the other platforms.
On Linux, Phorion says the code contains logic for that system. That does not by itself show an infected Linux package was distributed. Cursor lists macOS and Windows only.
What to do now
What Cursor says to do if you installed or updated to 2.1.312 or 2.1.313 on macOS or Windows during the window:
- Run Cursor’s validation check to see whether you are impacted.
- Search your endpoint, network and extension-installation telemetry for the indicators in its notice.
- Isolate any host showing signs the payload ran or a backdoor was installed.
- Remove the unauthorized SSH key, the persistence mechanisms and any running tunnel processes. Decide whether the host should be rebuilt. Cursor provides remediation scripts for macOS (run as the affected user, not as root) and Windows (run from PowerShell opened as Administrator). It says to follow the steps even if the SSH step would have failed on your machine.
- Rotate credentials and sessions reachable from the affected host, working from a trusted system.
Cursor lists its exact indicators, checks and scripts on its notice, and questions go to security@cursor.com. We did not copy them here. Use Cursor’s page, not a third-party summary, for those details.
Phorion’s advice for responders is similar. If you find an affected version, engage incident response. Remove persistence and planted keys, verify SSH was not enabled unexpectedly, and check SSH logs for suspicious logins.
We suggest these extra steps. They are our advice, not an official rule:
- Write down which machines run Cursor with the Claude Code extension, and the installed version on each.
- Follow Anthropic’s guidance as well as Cursor’s.
- If a machine was affected, treat it as potentially compromised and review SSH access and credential rotation with your security team.
Who is outside the notice’s scope?
- Anyone who never installed Claude Code from Cursor’s marketplace.
- Anyone whose installed version is not 2.1.312 or 2.1.313.
Linux users: Cursor names only macOS and Windows and does not say Linux is unaffected. Its indicator list also includes Linux entries it does not explain, so read the notice before you assume you are clear.
Cursor says it has no evidence the official distribution was affected, so users who got Claude Code only from Anthropic’s own channels are not covered by its notice.
We did not download or run the sample, and we did not test any machine. We cannot say whether your computer is clean. Only your own checks can.
Questions and answers
Is Claude Code itself compromised?
Not by Cursor’s account. Cursor says two packages distributed through its marketplace were tampered with. It has no evidence that the official distribution or other versions were affected.
I removed the extension. Am I done?
Not necessarily. Cursor warns that the payload drops standalone scripts that keep running after removal. Check for persistence and unknown SSH keys using Cursor’s steps.
Did the attacker get into machines?
Cursor says the tunnel step would fail in most cases, so Cursor expects the attacker could not log in through the tunnel on most hosts. Cursor also notes the code still collected host details, so credential rotation is part of its advice.
Why does the Phorion date differ from Cursor’s?
The incident was 29 October. Phorion published on 30 October and updated on 31 October to add version 2.1.312, citing Cursor’s notice.
Is the attacker’s server still active?
Cursor says it worked with the hosting provider to take the server offline, so the contact point no longer works.
Does the Linux code mean Linux users were hit?
No. Phorion says the code contains Linux logic. That alone does not prove an infected Linux package was distributed.
Terms in plain language
- VSIX: the package file format for extensions in VS Code-style editors such as Cursor.
- Extension marketplace: the catalog an editor uses to find and install extensions.
- SSH key: a credential that lets a remote person log in to a computer without a password.
- Reverse tunnel: an outbound connection that lets a remote party reach a machine behind a firewall.
- Persistence: code set up to keep running after restarts or after the original program is removed.
Sources
- Cursor: Claude Code extension security notice (29 October 2026, revised 30 October)
- Phorion: Claude Code VSX compromise analysis (30 October 2026, updated 31 October)
Facts read on 31 October 2026.
