Day 7 · 2026-10-31
20 launches checked81 claims quoted word for word130 user reports linked10 verified fixes linked26 corrections publishedLive 8 days5 of 5 founding sponsor spots left
Day 7Launch day vs. day 7
AI launches, checked against real usersLast re-stamped 31 Oct 2026

AI coding tools / Compare

Cursor Marketplace security notice (Claude Code extension) vs OpenCode 2.0: which delivered after 7 days?

OpenCode 2.0 is stamped Partly; Cursor Marketplace security notice (Claude Code extension) is still Too early to call, so this comparison isn't settled yet.

Cursor Marketplace security notice (Claude Code extension)OpenCode 2.0
VerdictToo earlyPartly
Claims held32
Claims mixed01
Claims failed01
Claims unclear21
User reports517
Launched29 Oct 202614 Oct 2026
Last stamped31 Oct 202630 Oct 2026

No. 017 · Cursor (Anysphere)

Cursor Marketplace security notice (Claude Code extension)

Day 2 of 7
Too earlyDay 7 verdict

Day 2: independent analyses back Cursor on the failed SSH step and the leftover persistence; the 5,000-user count and its own audit can't be checked from outside.

Launched
29 Oct 2026
Stamped
31 Oct 2026
Claims
✓3 held · ~0 mixed · ✗0 failed · ?2 unclear
Reports
5 (0 praise · 1 problem · 4 mixed)

What they claimed

“These malicious versions of the extension were not developed by Anthropic.”
✓ Holds
“Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.”
✓ Holds
“We audited access and confirmed no other extensions were tampered with.”
? Unclear
“Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.”
✓ Holds
“We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.”
? Unclear

Full receipt

No. 006 · Anomaly (OpenCode)

OpenCode 2.0

PartlyDay 7 verdict

The background service and Code Mode shipped as promised, but "backwards compatible" is wrong: V1 plugins and the old server API break.

Launched
14 Oct 2026
Stamped
30 Oct 2026
Claims
✓2 held · ~1 mixed · ✗1 failed · ?1 unclear
Reports
17 (1 praise · 13 problem · 3 mixed)

What they claimed

“In 2.0 this server now automatically runs as a single background process on your machine.”
✓ Holds
“All MCP servers in 2.0 are opted into code mode by default.”
✓ Holds
“First, we've added background subagents.”
~ Mixed
“There are a lot of other changes but they are backwards compatible.”
✗ Fails
“We also spent quite a lot of time ensuring everything in OpenCode 2.0 can be hot-reloaded.”
? Unclear

Full receipt

Both stamps come from the public user reports linked on each receipt, under the same method. Verdicts are opinion and are never paid for.

Keep comparingall AI coding tools