Cursor, the AI coding company owned by SpaceX, says a maliciously modified version of Anthropic’s Claude Code extension was available in its VS Code extension marketplace on 29 October 2026, and that “At most 5,000 users were affected”. Its security notice says the package, version 2.1.313, “was not developed by Anthropic”.
The notice puts the window at between about 2:27am and 1:35pm Pacific time. By our arithmetic that is 11 hours 8 minutes, or about 46% of the day. Reuters reported the incident on 30 October and wrote that Anthropic did not immediately respond to a request for comment.
Short explainer · Tampered Claude Code Add-On Hit Up to 5,000 Cursor Users
A vertical news Short narrated from this piece’s headline and opening line.
Business Pill · Least privilege
An evergreen Business Engineer explainer on least privilege. It teaches the general idea only and does not discuss Cursor or this incident.
The key insight: Cursor says a modified Claude Code extension that Anthropic did not develop was live in its marketplace for about 11 hours on 29 October 2026, affecting at most 5,000 users; by our arithmetic the window was 11 hours 8 minutes, about 46% of the day.
Cursor’s notice says the modified extension “runs malicious code that attempts to install a persistent SSH backdoor”. Reuters summarised Cursor’s account: the extension “attempted to collect host and user information such as hostname, username, operating system and public IP address” and “also attempted to set up remote access for the attacker”.
Cursor says a key step would usually fail. Its notice says turning on the local SSH service “requires admin rights, which the malicious extension does not have on most macOS and Windows hosts”, and that “The attacker server no longer functions”. It adds: “We have no evidence that other versions of the extension or the official distribution are affected”.
How long the malicious version 2.1.313 was live in Cursor’s extension marketplace on 29 October 2026, Pacific time, per Cursor’s security notice; the hour split is our arithmetic.
What Was Posted on X
โผ๏ธ BREAKING: Cursor’s extension marketplace served a backdoored Claude Code extension to up to 5,000 users.
For about 11 hours, version 2.1.313 planted an attacker’s SSH key and persistence. Cursor says Anthropic did not build it.
Cursor has not said how the rogue build got in.
— International Cyber Digest (@IntCyberDigest) Oct 30 11:17
International Cyber Digest (@IntCyberDigest) posted on 30 October that Cursor’s extension marketplace served a backdoored Claude Code extension, version 2.1.313, to up to 5,000 users for about 11 hours. The post adds that Cursor says Anthropic did not build it, and that Cursor has not said how the rogue build got in.
Weโre working with Cursor on this incident, but it wasnโt a compromise of Anthropicโs systems or employee laptops. A malicious actor used access to Cursorโs marketplace to publish a tampered copy of the Claude Code extension, which we didnโt build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
Felix Rieseberg of Anthropic says Anthropic is working with Cursor on the incident and that it was not a compromise of Anthropic’s systems or employee laptops. He says a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension that Anthropic did not build or publish, and that versions on Anthropic’s official channels are not affected; per his post, only Cursor users are impacted.
What Cursor Did
The notice lists the response: Cursor “Removed the malicious version from the marketplace immediately upon detection and blocked further distribution”, then shut the marketplace down “out of an abundance of caution”. It says it “audited access and confirmed no other extensions were tampered with” and “rotated our keys, rebuilt the marketplace, and brought it back online”.
In its post on X on 30 October, Cursor said the incident “does not impact other extensions” in its marketplace, and asked “all customers update to Claude Code for VS Code version 2.1.314”.
What Users Are Told to Do
Cursor’s guidance applies to anyone who installed or updated to version 2.1.313 from its marketplace in that window. The notice sets out steps for affected users and warns: “Uninstalling the extension may not be sufficient”. It also tells affected users to “Rotate credentials and sessions accessible from affected hosts, from a trusted system”. We do not reproduce the technical indicators here; they are in Cursor’s notice.
Why It Matters to the Business
Cursor is now part of a much larger company. In our piece on SpaceX’s third quarter, we reported that SpaceX completed its acquisition of Cursor on 14 August 2026, based on an implied equity value of $60 billion, and that Cursor contributed $608 million of revenue from the closing date to 30 September.
As we read Cursor’s notice, the package carried Anthropic’s extension name and a version number, so the marketplace listing itself was the point of trust that failed.
As we read the notice, two limits narrow the damage it describes: operating-system permissions block the SSH step on most hosts, and the attacker server was taken offline with the cloud provider. Cursor still tells affected users to clean up and rotate credentials.
As we read our earlier coverage, this is a second kind of risk next to the ones we reported this autumn: Plugin4Shell was a flaw in how plugins were checked, while here Cursor says a malicious version was distributed.
Cursor, security notice
“This malicious version of the extension was not developed by Anthropic”
Three Implications
FOR AFFECTED USERS Cursor’s notice says uninstalling the extension may not be sufficient and tells users to rotate credentials and sessions accessible from affected hosts, from a trusted system.
FOR CURSOR Cursor says it audited access, confirmed no other extensions were tampered with, rotated its keys and rebuilt the marketplace before bringing it back online.
FOR ANTHROPIC Cursor says the package was not developed by Anthropic, and Reuters reported that Anthropic did not immediately respond to a request for comment.
The framework opens: “The surface, not the model, governs autonomy.”
As we read Cursor’s notice, the incident sat at that surface: an extension package distributed through Cursor’s marketplace, not the Claude model itself. The framework was published in July 2026 and does not discuss this incident.
What Is Not Established
Cursor has not said in the sources we read how the modified package reached its marketplace, or how many of the up to 5,000 users had the backdoor installed. The notice says the package sends host details to the attacker, and that the attacker server is now offline. Anthropic had not commented when Reuters published. The 5,000 figure is Cursor’s upper bound, not a count of compromised machines.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
What happened next (30 Oct): Separately, security firm Radware published a report on 29 October saying it found 83 verified malicious items across 61 public GitHub repositories, including Google’s LangExtract, Trivy and Brave, all published on 1 September 2026. Radware says it found evidence the command ran in two cases and did not establish that any repository was taken over. Our follow-up has the details.
What happened next (30 Oct): how the package reached users.Ars Technica reported on 30 October that it is โstill unknown how attackers got access to Anthropicโs verified Cursor accountโ. Ars quotes Luke Roberts, CTO and co-founder of security firm Phorion, calling it โa supply-chain compromise where the attacker gained access to the official distributionchannelโ; Roberts says โThe malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312โ and that โExtensions auto-update in Cursor by defaultโ. Ars tells anyone who installed or updated the extension from Cursor between 5:27am and 4:35pm Eastern time on Thursday to consider themselves affected; by our arithmetic that is the same 11 hours 8 minutes as Cursorโs Pacific-time window above. Phorionโs advisory tells organisations to โimmediately review their environments for use of Claude Code for VSCode 2.1.313 and engage incident response where use of the extension is discoveredโ. Ars says Cursor worked with the cloud provider hosting the attackerโs server so infected devices could no longer reach it, and that the marketplace is now open again. Ars also says Anthropic had yet to issue a public notice to customers and that neither company answered its questions about how the compromise happened; Anthropicโs Felix Rieseberg addressed the incident on X, in the post embedded above.
The Bottom Line
Cursor says a modified Claude Code extension that Anthropic did not develop was live in its marketplace for about 11 hours on 29 October 2026, affecting at most 5,000 users. It says it removed the package, rebuilt the marketplace and asked customers to update to version 2.1.314.
A note on sourcing. The incident details, timings, user count and remediation guidance come from Cursor’s security notice and its post on X, which we read on 30 October 2026. The SpaceX ownership line and Anthropic’s lack of comment come from Reuters. We have deliberately left out the technical indicators of compromise; affected users should follow Cursor’s notice directly. We have not examined the package.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
