Cursor says an attacker used an access key it had issued to AI infrastructure provider Fireworks to gain access to some of its internal systems and customer-related data, then publish malicious copies of Anthropic’s Claude Code extension in Cursor’s VS Code marketplace. In a November 13 investigation report, the company traced the intrusion from a shared data bucket to selected internal services.
According to Cursor, the key was exposed on Fireworks’ side. It allowed the attacker to copy a read-only storage bucket containing historical coding-agent traces, mostly from 2025, from sessions that were not in Privacy Mode and could be used for model training. A small number of those traces contained unredacted credentials. The attacker used them to reach selected software-as-a-service tools and access archived, non-production source-code repositories, limited customer support data and email conversations, product usage metrics, contact details, summaries of some coding-agent conversations and credentials users had sent to support. Fireworks had separately disclosed an October security incident involving customer account data and, for a limited set of accounts, secrets and datasets, as described in Abijita’s report on the Fireworks breach.
Cursor said coding-agent traces were exposed for fewer than 0.05% of users who were not using Privacy Mode, while less than 0.01% of customers had API credentials exposed. It said affected customers had been contacted directly. Prompts and code from users with Privacy Mode enabled, live traffic, production infrastructure, official Cursor application releases, customer code repositories and other marketplace extensions were not affected.
The stolen credentials also let the attacker place malicious copies of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, in Cursor’s marketplace on October 29. Cursor said the builds were available for about 11 hours and that up to 5,000 users who requested the affected cached versions may have received them. Anthropic did not publish the copies, and the Open VSX marketplace never contained the malware. The versions attempted to install persistent SSH backdoors on developer systems, as described in Abijita’s report on the malicious Claude Code packages. Cursor’s original security notice lists the affected versions and indicators of compromise.
Cursor said the last attacker activity it observed was on November 1 and that it believes the incident is contained. It has revoked the Fireworks key, rotated exposed credentials, moved inference traffic away from Fireworks, rebuilt its extension marketplace, redeployed production infrastructure and engaged external forensics experts.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
