{
  "id": 17340905,
  "title": "Anthropic says a malicious actor used access to Cursor's marketplace to publish a \"tampered\" copy of the Claude Code extension, which it didn't build or publish (Felix Rieseberg/@felixrieseberg)",
  "url": "https://urgent.news/2026/10/31/anthropic-says-a-malicious-actor-used-access-to-cursors-marketplace",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-31T05:00:15.000Z",
  "source": {
    "name": "Techmeme",
    "slug": "techmeme",
    "url": "https://x.com/felixrieseberg/status/2116170451466543578"
  },
  "original_language": "en",
  "account": null,
  "summary": "Anthropic reported that a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension. Techmeme reports that the company is working with Cursor on the incident but noted it was not a compromise of Anthropic’s employee laptops or internal systems.\n\nArs Technica reports the compromised VS Code extension was version 2.1.313, which was distributed through Anthropic's official account on Cursor. This version may have affected at most 5,000 users through manual downloads or automatic updates. Luke Roberts, the CTO and co-founder of security firm Phorian, described the event to Ars Technica as a supply-chain compromise where the attacker gained access to the official distribution channel. Neither Cursor nor Anthropic has explained how the account was accessed.\n\nIn separate news, Anthropic has updated its pricing and usage policies. The New Stack reports that Claude Code users on the $200 \"Ultra\" plan—formerly known as Max 20x—will no longer face a rolling five-hour usage cap, provided their accounts are verified. Additionally, Dev.to reports that Anthropic added a server-side rule to Claude Code for the Opus 5.5 model to prevent it from recreating specific existing games, a move Anthropic technical staff member Addy Osmani stated was intended to avoid IP infringement.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 4,
    "also_reported_by": [
      {
        "outlet": "TechSpot",
        "title": "Anthropic manager drops coding interviews after realizing Claude is better at them than most applicants",
        "url": "https://urgent.news/2026/10/30/anthropic-manager-drops-coding-interviews-after-realizing-claude-is",
        "published": "2026-10-30T13:41:00.000Z"
      },
      {
        "outlet": "Lobsters",
        "title": "Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide",
        "url": "https://urgent.news/2026/10/30/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer",
        "published": "2026-10-30T13:58:45.000Z"
      },
      {
        "outlet": "The New Stack",
        "title": "Anthropic just removed one of Claude’s biggest usage limits — but not for everyone",
        "url": "https://urgent.news/2026/10/30/anthropic-just-removed-one-of-claudes-biggest-usage-limits-but-not",
        "published": "2026-10-30T20:14:04.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}