This week a headline went round my feeds: Anthropic had been hacked, and a trojan had been delivered to Claude developer laptops worldwide. It was shared with shocked faces and “who knows how bad this is”. I use AI tools in my own website work, so I wanted to know what actually happened before I worried, or passed it on.

So I read the sources instead of the screenshots: the security notice from Cursor, the code editor where it happened, the technical write-up from Phorion, the security firm that found it, and the original blog post by Kevin Beaumont.

What really happened

On 29 October 2026, tampered copies of the Claude Code extension, versions 2.1.312 and 2.1.313 for Windows and Mac, were published on Cursor’s extension marketplace. They were there for about eleven hours. Anyone who installed one, or whose editor updated to one automatically, got a hidden backdoor: it added the attacker’s key to the computer’s SSH settings, tried to open a tunnel back to the attacker, set itself up to restart after a reboot, and sent basic details about the machine to the attacker’s server.

That is serious, and it is real. But several parts of the headline do not hold up.

  • Not millions. Cursor’s first notice put the number at no more than 5,000 users. Its updated notice no longer gives a figure, but the bad versions were only on Cursor’s own marketplace, for less than a day.
  • Not everyone who uses Claude. Only the copy downloaded through Cursor’s marketplace was affected. People using Claude in a browser or an app were not.
  • “Anthropic hacked” is disputed. Anthropic says someone used access to Cursor’s marketplace and that Anthropic did not build or publish the tampered version. Beaumont points out that it appeared under Anthropic’s verified name, and he has since changed his headline to “Anthropic hacked via Cursor”. I do not know yet who is right, and I would rather say that than guess.
  • The worst part mostly failed. Turning on remote login needs administrator rights, and bugs in the malicious code meant that step usually did not work on Mac and Windows. The planted key and the data sent home still matter, which is why affected users are told to clean up anyway.
  • It has been contained. The bad versions were removed, Cursor rebuilt its marketplace, and the attacker’s server has been taken offline.

If you or your developer use Cursor

Cursor’s notice gives a one-line check. On a Mac:

grep svc-telemetry ~/.ssh/authorized_keys

If that finds nothing, the machine is not affected. If it finds a match, follow Cursor’s clean-up steps and change any passwords or keys that computer could reach. Uninstalling the extension on its own does not remove the backdoor.

The lesson I am keeping

The panic was bigger than the problem, but the problem points at something real. The tools we install into our editors run with our own permissions, and many of them update themselves quietly. One poisoned update in a trusted place can reach thousands of machines in a morning, without anyone clicking anything.

So I am taking two habits from this. First, read past the headline to the source before sharing: the first version of a story is rarely the most accurate one. Second, treat extensions and plugins like any other software you let into your work: install fewer, prefer official sources, and keep an eye on what changes when they update. It is the same rule I follow in how I build and look after websites, where every plugin is one more thing that can go wrong.

Sources: Cursor’s security notice, Phorion’s technical analysis, Kevin Beaumont’s post. Details are as reported on 31 October 2026, including Cursor’s update of 30 October, and may change as the investigation continues.

Send a message