Cursor says an access key exposed at Fireworks AI let attackers reach internal data and publish malicious Claude Code builds through its marketplace.