Yes. Cursor said at most 5,000 users

The claim says up to 5,000 machines downloaded or installed the compromised extension. That matches Cursor's disclosure of at most 5,000 affected users and Beaumont's estimate of about 5,000 downloads. This is an upper bound on exposure, not a count of successful compromises. Calling it a Claude Code extension "patch" is loose. It was a malicious version posted to Cursor's marketplace under Anthropic's extension name, not an official Anthropic release. Figures could be revised as the investigation continues.

• The malicious build was live in Cursor's extension marketplace for about 11 hours on 29 October 2026.
• Cursor said at most 5,000 users were affected, and Kevin Beaumont estimated roughly 5,000 systems.
• The affected versions were 2.1.312 and 2.1.313, aimed at Windows and macOS; version 2.1.314 is the clean update.
• Anthropic did not write the malicious versions, and its own systems were not compromised.
• The 5,000 figure counts downloads or exposure. Admin rights were usually missing, so the SSH backdoor often failed, and the number of machines actually reachable is likely lower.

1. Devs Hit by Trojanized Claude Code Extension for Cursor darkreading.com
2. Malicious Claude Code Extension Served in Cursor Supply Chain Attack - SecurityWeek securityweek.com
3. Trusted Tool, Malicious Build: What the Trojanized Claude Code Extension Means for Developer Endpoints morphisec.com
4. Trojanized Claude Code Extension Hits Cursor IDE: Supply-Chain Attack 2026 aviatrix.ai
5. Malicious Claude Code extension distributed through Cursor marketplace with SSH backdoors - The Back Room Tech thebackroomtech.com
6. Malicious Claude Code Cursor Extension Planted SSH Backdoors aviatrix.ai
7. Hackers Compromise Claude Code Extension in Cursor Marketplace to Install Persistent SSH Backdoor cyberpress.org
8. Cursor Says Tampered Claude Code Extension Reached Up to 5,000 Users technology.org

The claim accurately conveys the initially reported scale of downloads or installations. However, users and machines are not necessarily a one-to-one count, and downloading the malicious extension does not establish successful attacker access. Cursor says errors and administrator-permission requirements prevented remote login on most affected hosts. Its revised notice does not provide an affected-user total, so 5,000 should remain attributed to the initial estimate.

• Cursor's initial upper-bound estimate was 5,000 affected users, rather than an independently verified machine count.
• The affected packages were modified Claude Code extension versions 2.1.312 and 2.1.313 for macOS and Windows in Cursor's marketplace.
• The distribution window was approximately 2:27 a.m. to 1:35 p.m. Pacific time on October 29, 2026.

1. wired.com
2. newruntime.com
3. futuretweets.com
4. channelnewsasia.com
5. stepsecurity.io
6. postcutoff.com
7. ally.security
8. blog.toolsnetwork.ai

On October 29, 2026, attackers distributed trojanized builds of the Claude Code extension through the marketplace hosted by the AI code editor Cursor. Cursor disclosed the supply-chain incident the same day, removed the malicious packages, and reported that at most 5,000 users had been affected. Security analyses confirmed the altered package attempted to install an SSH backdoor and exfiltrate host metadata before the command-and-control server and extension were taken offline.

• On October 29, 2026, trojanized builds (versions 2.1.312 and 2.1.313) of the Claude Code extension were published to the Cursor extension marketplace.
• Cursor's security disclosure estimated that up to 5,000 developer machines received the malicious builds during the roughly 11 hours they were live.
• The malicious packages contained a loader designed to harvest system metadata, inject an unauthorized SSH key, and establish persistence.
• The incident was confined to Cursor's independent marketplace; Microsoft's official VS Code Marketplace and npm packages were not compromised.
• Anthropic confirmed its internal systems and official release repositories were not breached.

1. microsoft.com
2. cursor.com
3. thehackernews.com
4. aviatrix.ai

The claim matches what the company that distributed the package said: Cursor's own estimate is that no more than about 5,000 developer machines downloaded the compromised extension, and this figure is repeated across the reporting. The important caveat is that 5,000 is an upper-bound estimate from Cursor, not a confirmed tally of successful infections, and reports say the malware's own bug prevented full compromise on most machines. That does not change the claim as worded (downloads/installs, up to 5,000), which the available evidence supports.

• Cursor put the exposure at "at most 5,000 users" after a malicious update to its Claude Code extension (version 2.1.313) was live in its marketplace for about 11 hours, from 02:27 to 13:35 PT on 29 October 2026.
• The implant added an attacker SSH key to ~/.ssh/authorized_keys, tried to open a reverse SSH tunnel, and gathered host details and environment-variable names.
• Anthropic said the incident was not a breach of its own systems or employee laptops, and that versions on its official channels were unaffected; only Cursor users were exposed.
• Researchers reported a flaw in the malware's design that blocked it from fully establishing persistence on most targets.
• Cursor pulled the package, briefly shut its marketplace, rotated keys and urged users to move to version 2.1.314, though upgrading alone does not remove the persistent scripts.

1. A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices wired.com
2. Официальное расширение Claude Code оказалось зараженным: что известно - Официальное расширение Claude Code оказалось зараженным: что известно hi-tech.mail.ru
3. Tampered Claude Code extension hit up to 5,000 Cursor users thenextweb.com
4. Anthropic: That Claude Code extension compromise… couldn't be us theregister.com
5. Claude Code Cursor truva atı 5000 sistemi vurdu | ShiftDelete.Net shiftdelete.net
6. Claude Code su Cursor, l'estensione con la backdoor SSH digitalworlditalia.it

Multiple independent sources, including Cursor’s own security notice and reports from The Hacker News, WIRED, StepSecurity, OX Security, and others, confirm that the compromised Claude Code extension (version 2.1.313) was downloaded or installed by up to 5,000 developer machines during the 11-hour window on October 29, 2026. This figure is described as the upper bound of affected users, not a confirmed count of successful compromises, but it directly answers the claim as posed.

• The compromised extension was version 2.1.313 of Anthropic.claude-code.
• It was available in the Cursor VS Code Extension Marketplace for about 11 hours on October 29, 2026.
• Cursor stated that up to 5,000 users downloaded or installed the malicious version.
• The malicious version was not developed or published by Anthropic, but by a third party who gained access to Cursor’s marketplace.
• The extension contained a persistent SSH backdoor and added an attacker-controlled SSH key.

1. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor thehackernews.com
2. A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices | WIRED wired.com
3. Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines - StepSecurity stepsecurity.io
4. Compromised Claude Code extensions (versions 2.1.312 & 2.1.313) in Cursor try to install a backdoor - OX Security ox.security
5. Claude Code Extension Backdoored on Open VSX and Cursor | CellCog cellcog.ai
6. Tampered Claude Code Extension: 5,000 Cursor Users [2026] shattered.io
7. Fake Claude Code Extension Hit 5,000 Cursor Users [2026] tech-insider.org
8. Cursor Confirms Anthropic Claude Code Extension Compromised bankinfosecurity.com