Cursor has confirmed that the malicious Claude Code extension that hit its marketplace on October 29 was the final stage of a wider breach, one that began with an access key exposed by AI infrastructure provider Fireworks AI and ended with attackers inside several of Cursor’s internal tools.
In an incident update published November 13, the company behind the popular AI code editor said the attacker used that key to copy historical coding agent traces, pulled unredacted credentials out of those traces and used them to reach customer support data, archived source code repositories and the credential that let them plant the trojanized extension.
It started with a key held by Fireworks
Cursor had issued an access key to Fireworks so the vendor could read a storage bucket the two companies used to share data. According to Cursor, the key was exposed by Fireworks, and the attacker used it to copy data from that read-only bucket.
The bucket held limited coding agent traces, mostly from 2025, taken from sessions where users had not turned on Privacy Mode and had allowed their data to be used for model training. Some of those traces contained credentials that had never been redacted. Cursor says fewer than 0.05% of users had traces exposed and fewer than 0.01% of customers had API credentials exposed.
Those leaked credentials became the attacker’s way in. Starting with them, the intruder reached select software-as-a-service tools Cursor uses internally and accessed:
- Select archived, non-production Cursor source code repositories, some containing business contact information
- Limited customer support data and email conversations
- Product usage metrics and contact details
- Summaries of some coding agent conversations
- Some credentials that users had sent to Cursor’s support team
How the Claude Code extension was poisoned
Among the stolen material was a credential that gave access to the cache serving Cursor’s VS Code extension marketplace. On October 29, the attacker used it to place malicious, unauthorized copies of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, directly on that cache.
Cursor stressed that Anthropic did not publish the tampered copies, that the incident was not a vulnerability in Anthropic’s product and that Open VSX, the upstream marketplace source, never carried the malware. At most 5,000 users who requested those cached versions on October 29 may have received the malicious build, which stayed live for about 11 hours. As BreachNews reported at the time, the payload tried to plant an attacker-controlled SSH key, open a reverse SSH tunnel and set up persistence on Windows and macOS machines.
Cursor says anyone who installed or updated to either version from its marketplace during that window should follow the steps in its original security notice, adding that uninstalling the extension alone may not be enough.
What Cursor says was not affected
The company says the attacker never reached its production systems or the separate code hosting system it uses to ship the Cursor app, and that no release signing keys were exposed. According to Cursor, the following were also untouched:
- Prompts and code from users with Privacy Mode turned on
- Live traffic and active inference requests
- Customer code repositories
- Official Cursor app releases and updates
- All other extensions in its marketplace and any plugins from the Cursor Marketplace
Cursor says the last attacker activity it saw was on November 1, and that attempt was blocked. It believes the incident is contained.
Cursor cuts ties with Fireworks
Cursor has moved all inference traffic off Fireworks, deactivated the key it issued to the vendor and cut off its access to every shared data set. It also says it:
- Rotated every exposed credential it found, then rotated all credentials across its internal systems as a precaution
- Rebuilt its VS Code extension marketplace after confirming every other extension was authentic
- Restricted where vendor credentials can be used, so a stolen key cannot work outside its intended location
- Added secret scanning across its code repositories and other internal data sources
- Redeployed all production infrastructure and brought in outside forensics experts
Affected users and team admins were contacted directly. Where credentials were exposed, Cursor says it emailed team admins a list of the specific keys to rotate and asked the services that issued them to revoke them. The company apologized and said it “can and must do better.”
Fireworks fallout keeps spreading
Cursor is now the third major company to tie its own incident to Fireworks. The San Mateo AI hosting provider widened its own disclosure on November 9 to include billing data, stored secrets, datasets and incomplete model weights, and Notion has confirmed that AI chat transcripts from some workspaces were exposed. Days ago, Uber confirmed that driver’s license images belonging to nearly 12,000 drivers were stolen using compromised Fireworks credentials.
Fireworks has linked its breach to a financially motivated group that sells stolen access to large language models, a practice known as LLMJacking, and says it is working with Palo Alto Networks Unit 42. Fireworks’ public bulletin does not mention Cursor, and Cursor does not say exactly when the key was taken. The incident fits the wider October wave of attacks on AI developer platforms that BreachNews tracked alongside the Northflank breach and Railway’s decrypted customer secrets.
What Cursor users should do
The lesson here is simple: secrets pasted into an AI coding session can end up in logs, traces and training data far from where they were typed. Cursor users who received a notice should rotate every key it lists, even ones they think are unused. Anyone who sent passwords or tokens to Cursor support should change them. Teams that installed Claude Code 2.1.312 or 2.1.313 from Cursor’s marketplace should follow Cursor’s cleanup steps and check for unknown SSH keys. Our guide on how to rotate leaked API keys after a platform breach walks through the process.
