Cursor warns malicious Anthropic.claude-code 2.1.313 hit its extension marketplace
On October 29, 2026, Cursor disclosed that a counterfeit Anthropic.claude-code extension, version 2.1.313, appeared in the Cursor VS Code Extension Marketplace. Cursor stated the build was not published by Anthropic and included code that attempted to install a persistent SSH backdoor on affected machines. The company estimated that at most five thousand users installed the tampered package, making supply-chain integrity in editor marketplaces an immediate operational concern for anyone who installs coding agents from third-party catalogs. The incident sits alongside separate community reports that legitimate Claude Code builds can silently consume substantial token or rate-limit headroom on background agent status summaries, which the packet does not tie to this malicious release. Operators should verify extension publisher identity, compare version hashes against vendor notices, and monitor telemetry before trusting marketplace installs.
Cursor warns malicious Anthropic.claude-code 2.1.313 hit its extension marketplace
Cursor reported a security incident on Oct 29, 2026 involving Anthropic.claude-code version 2.1.313 in the Cursor VS Code extension Marketplace and said that build was not from Anthropic. The tampered extension ran code that tried to install a persistent SSH backdoor; Cursor said at most 5,000 users were affected.
Key takeaway
A tampered Claude Code marketplace build can deploy persistent access machinery; publisher verification is not optional for agent extensions.
What happened
Cursor reported a security incident on October 29, 2026 involving Anthropic.claude-code version 2.1.313 listed in the Cursor VS Code extension Marketplace and said that build was not from Anthropic.
According to Cursor, the tampered extension ran code that tried to install a persistent SSH backdoor, and at most 5,000 users were affected. The same evidence packet also carries unrelated Claude Code items on OpenRouter session costs, background agent summarizer token use, Anthropic hiring anecdotes, a Les Echos workplace video headline, GSA discount reporting, and usage-limit workarounds.
Evidence
Cursor identified malicious Anthropic.claude-code 2.1.313 in its marketplace that was not from Anthropic.
Cursor Blog · attributed
Cursor reported a security incident on Oct 29, 2026 involving Anthropic.claude-code version 2.1.313 in the Cursor VS Code extension Marketplace and said that build was not from Anthropic.
The tampered extension attempted to install a persistent SSH backdoor and affected at most 5,000 users.
Cursor Blog · attributed
The tampered extension ran code that tried to install a persistent SSH backdoor; Cursor said at most 5,000 users were affected.
Community reporting says Claude Code 2.1.257–2.1.312 sends each background agent transcript to its model about every 30 seconds for a short status line.
Hacker News AI · attributed
A Hacker News post reports that Claude Code versions 2.1.257–2.1.312 send each background agent's entire transcript to its own model roughly every 30 seconds to generate a 3–5 word status line
OpenRouter publishes median costs of real Claude Code sessions by model and session length.
OpenRouter · attributed
We publish the median cost of real Claude Code sessions on OpenRouter by model and session length.
Anthropic hiring manager Felix Rieseberg says he stopped traditional coding interviews because Claude is better at them.
Techmeme · attributed
This month, I laid the traditional coding interview to rest. As a hiring manager at Anthropic, I stopped asking candidates to do them.
Anthropic expanded a US GSA partnership offering governments a 40% Claude discount estimated to save $1B.
Techmeme · attributed
Anthropic expands its US GSA partnership to give federal, state, local, tribal, and territorial governments a 40% discount on Claude, estimated to save $1B
Why it matters
Editor marketplaces that distribute branded agent extensions inherit supply-chain risk that version numbers alone cannot validate without vendor-signed release channels and post-install monitoring.
Limits and uncertainties
The packet does not explain how the malicious 2.1.313 build entered the Cursor marketplace or whether Anthropic has commented on that specific tampered release.
Background summarizer token spend claims rest on community measurements and a third-party Bun preload workaround, not an official Anthropic statement on intent or billing.
Felix Rieseberg hiring comments are one manager's stated practice, not a documented company-wide Anthropic policy.
The Les Echos workplace video excerpt provides only a title with no described metrics or verified outcomes.
Practical implications
Treat marketplace installs of Anthropic.claude-code as high-risk until publisher identity and version match Cursor's security notice.
Use OpenTelemetry or equivalent request telemetry to separate agent_summary spend from primary coding work when planning rate limits.
Use OpenRouter session medians as indicative budgeting inputs, not definitive invoices, when Claude Code routes through their platform.
When Claude Code plan windows cap usage, OpenRouter documents routing the tool through an API key as a documented overflow path with per-token billing.
What to watch
Further Cursor or Anthropic guidance on remediation, revocation, and publisher attestation for extension 2.1.313.
Whether Anthropic acknowledges or adds controls for the reported default background agent summarizer behavior.
Official follow-up on the GSA 40% discount rollout scope versus the stated $1B savings estimate.
