They don't agree.

The incident is real: a trojanized Claude Code extension that tried to install an SSH backdoor was served through Cursor's marketplace. But the claim that Anthropic's official account published it is not supported. Anthropic, Cursor and Microsoft all say an attacker used access to Cursor's marketplace to publish it. The tampered builds used Anthropic's extension ID, which is why they appeared official. Anthropic then released clean version 2.1.314. Attribution rests mainly on statements from the companies involved. Nothing found suggests Anthropic's own account or systems were the source.

• The tampered versions were live on the Cursor marketplace for about 11 hours on October 29, 2026.
• Anthropic said a malicious actor used access to Cursor's marketplace to publish a tampered copy it did not build or publish.
• Microsoft says Anthropic told it that its systems were not compromised.
• The tampered versions went out under the legitimate extension ID anthropic.claude-code, so they looked official.
• Cursor says at most 5,000 users were affected. It removed the versions, rotated keys and rebuilt the marketplace.

1. Malicious Claude Code Extension Served in Cursor Supply Chain Attack - SecurityWeek securityweek.com
2. Inside a malicious Claude Code-branded extension and its persistent SSH backdoor microsoft.com
3. Devs Hit by Trojanized Claude Code Extension for Cursor darkreading.com
4. Cursor removes malicious Claude Code extension after SSH backdoor attempt csoonline.com
5. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor thehackernews.com
6. Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines - StepSecurity stepsecurity.io
7. Trojanized Claude Code 2.1.312 and 2.1.313 in Cursor Marketplace Plants SSH Backdoor rescana.com
8. Felix from Anthropic here. We’re working with Cursor on this incident, but it wa... news.ycombinator.com

The distinction is between the account used for distribution and who actually authorized the release. The evidence supports publication under Anthropic’s official marketplace identity, but not that Anthropic deliberately published malware. Microsoft reported that Anthropic confirmed its systems were not compromised, and the available evidence placed the incident within Cursor’s marketplace.

• Researcher Kevin Beaumont reported that the malicious extension was uploaded as Anthropic’s verified account.
• Cursor identified tampered packages numbered 2.1.312 and 2.1.313 and removed them from its marketplace.
• Microsoft confirmed that the malicious packages were not distributed through Visual Studio Marketplace or Anthropic’s npm package.

1. tomshardware.com
2. prod.cursor.com
3. cursor.com
4. cursor.com
5. microsoft.com
6. wired.com
7. arstechnica.com
8. cursor.com

In late October 2026, a supply-chain incident made trojanized versions of the 'anthropic.claude-code' extension available to users of the Cursor code editor. The injected code attempted to establish a persistent SSH backdoor on developer machines. While the malicious package appeared under Anthropic's legitimate extension identifier in Cursor's catalog, security disclosures from Anthropic, Microsoft, and Cursor confirmed that Anthropic itself was never breached. The threat actor leveraged access into Cursor's marketplace distribution pipeline rather than an official Anthropic account.

• On October 29, 2026, trojanized builds of the Claude Code extension (versions 2.1.312 and 2.1.313) appeared on Cursor's marketplace.
• Anthropic, Cursor, and Microsoft confirmed that Anthropic's accounts and systems were not compromised.
• The malicious packages were not published by Anthropic and did not appear on Microsoft's Visual Studio Marketplace, Open VSX, or npm.
• The incident was confined to Cursor's marketplace infrastructure for approximately 11 hours before being taken down.

1. microsoft.com
2. ycombinator.com
3. thehackernews.com
4. cursor.com

The claim mixes up two things that did happen: a malicious build of the Claude Code extension was published to Cursor's marketplace under the Anthropic.claude-code name, and it was downloaded by thousands of users. But the question says Anthropic's official account published it, and the evidence from both Cursor and Anthropic attributes the upload to a malicious actor with access to Cursor's marketplace, not to Anthropic or its publishing credentials. Because the answer turns on who published it rather than on whether a bad version existed at all, the claim as asked is false. How the attacker got publishing access is still under investigation, so the surrounding details may change.

• Cursor's security notice says versions 2.1.312 and 2.1.313 of Anthropic.claude-code on its marketplace were malicious and were not developed by Anthropic.
• Anthropic's Felix Rieseberg said the incident 'wasn't a compromise of Anthropic's systems or employee laptops' and that a malicious actor used access to Cursor's marketplace to publish a tampered copy.
• The tampered extension was available for about 11 hours on 29 October 2026 and was downloaded by 'at most 5,000 users', according to Cursor.
• The malicious code tried to add an attacker-controlled SSH key, enable SSH, and open a reverse tunnel; a flaw in the code meant the SSH step failed on most hosts lacking admin rights.
• Anthropic published a clean version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace after the incident; Cursor removed the bad versions and shut the marketplace briefly.

1. セキュリティに関するお知らせ — Cursor VS Code 拡張機能マーケットプレイスで Anthropic.claude-code の悪意あるバージョン（2.1.312 および 2.1.313）を確認 · Cursor cursor.com
2. Tampered Claude Code extension hit up to 5,000 Cursor users thenextweb.com
3. Anthropic: That Claude Code extension compromise… couldn't be us theregister.com
4. A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices wired.com
5. Claude Code Extension Trojanized on Cursor Marketplace with SSH Backdoor Add a tag - RH-ISAC rhisac.org
6. 安全公告：Cursor VS Code 扩展市场中发现恶意版本的 Anthropic.claude-code（2.1.312 和 2.1.313） · Cursor cursor.com

Multiple reputable sources confirm that a malicious version of the Claude Code extension was published to Cursor's marketplace under Anthropic's official account. The malicious version was not created or published by Anthropic, but was distributed using their legitimate publisher identity on Cursor's platform. The incident was the result of a supply-chain compromise, where the attacker gained access to Cursor's marketplace, not Anthropic's internal systems. The malicious version was removed on October 29, 2026, and the marketplace was temporarily shut down for investigation.

• A malicious version of Anthropic's Claude Code extension (2.1.312 and 2.1.313) was published to Cursor's VS Code Extension Marketplace on October 29, 2026.
• The malicious version was published under Anthropic's official account on Cursor's marketplace.
• Anthropic stated the incident did not involve a compromise of its systems or employee laptops.
• The malicious version was available for about 11 hours and affected up to 5,000 users.
• Cursor removed the malicious version and temporarily shut down its marketplace to investigate.

1. Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor thehackernews.com
2. Anthropic: That Claude Code extension compromise… couldn't be us theregister.com
3. A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices | WIRED wired.com
4. Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor cursor.com
5. Anthropic VS code extension on Cursor backdoored for nearly 12 hours - Ars Technica arstechnica.com
6. Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines - StepSecurity stepsecurity.io
7. Backdoor in Claude Code for VS Code extension on the Cursor Marketplace | Hacker News news.ycombinator.com
8. Malicious Claude Code Extension Served in Cursor Supply Chain Attack - SecurityWeek securityweek.com