On October 29, two builds of the Claude Code extension in Cursor’s marketplace were swapped for tampered ones. Versions 2.1.312 and 2.1.313 went up under Anthropic’s verified account and name, with a 66-line loader inserted ahead of the real extension code, and the loader ran as soon as the editor opened. The two builds were available for about 11 hours, and Cursor said on X that at most 5,000 users installed or updated to them.

Anthropic did not write that loader, and it did not publish these builds. In its words, a malicious actor “used access to Cursor’s marketplace to publish a tampered extension,” and Anthropic “was not involved with building, publishing, or hosting this.” The attacker got into Cursor’s publishing path, and the file was changed before it reached you.

When did you last open the authorized_keys file on your own machine? Would you recognize every key in it?

I ask because the path this attack took ends at that file. Here is what the loader did, so the checks below make sense.…