Cursor, which makes a code editor, says a tampered copy of Anthropic's Claude Code add-on sat in the editor's add-on store for about 11 hours on Thursday, Oct. 29, between about 2:27 a.m. and 1:35 p.m. Pacific time. Cursor says the copy, labeled versions 2.1.312 and 2.1.313, for Mac and Windows, was not made by Anthropic. Cursor first said at most 5,000 users were affected.
The add-on is Anthropic's official way to use Claude Code inside code editors. StepSecurity, a security company that examined the copy, says it was the real add-on with a small piece of hidden code added, and that the code ran as soon as the editor loaded the add-on, without anyone using Claude.
Cursor says the copy collected details about the computer, including its name, the user's account name and its public internet address, along with the names of stored settings, which StepSecurity says can show which passwords and access keys are on the machine. It sent them to the attacker. The copy also added the attacker's digital key, a code that works like a password, to the computer's list of keys trusted for remote login, which lets someone run the computer from elsewhere over the internet. It then tried to turn remote login on and to open a connection from the computer out to the attacker's server, which the attacker could use to reach back in, and set it to retry about every minute.
Cursor says the remote login part would have failed on most computers, both because of errors in the attacker's code and because turning on remote login needs administrator rights, the full control of a computer that apps don't usually run with. On most Mac and Windows computers, it says, the attacker could not have logged in that way, though the key, the details and the leftover files still got through.
Cursor says it pulled the copy and then shut down its whole add-on store as a precaution. It says it found no other add-ons tampered with, changed its own security keys, rebuilt the store and brought it back online. It also says it worked with the company hosting the attacker's server to take that server offline, so it no longer works.
Anthropic says it did not build or publish the copy, that its own systems were not broken into, and that the tampered version never appeared on Open VSX, the open add-on store Cursor's store copies from, or on Microsoft's store, so only Cursor users were affected. The copy carried Anthropic's real add-on name, not a lookalike, and Anthropic skipped to version 2.1.314 to avoid confusion.
Removing versions 2.1.312 and 2.1.313 may not be enough, Cursor says, because the copy leaves behind separate programs that keep running. Cursor has published a short check for the attacker's key, labeled svc-telemetry, and cleanup scripts, and advises changing passwords, access keys and other logins the computer could reach, from a different, trusted computer. StepSecurity says any computer that installed version 2.1.313 between Oct. 29 and Oct. 30 should be considered compromised. Cursor has not said how the attacker got access to its store.
Correction (Oct. 31): an earlier version said the tampered copy was published on Open VSX and named only version 2.1.313. Anthropic says the copy never appeared on Open VSX or Microsoft's store, and Cursor now names versions 2.1.312 and 2.1.313. Cursor's notice no longer gives the 5,000 figure or says it will contact the users.