Cursor Says Its Breach Began With an Access Key Exposed by Fireworks and Led to a Fake Claude Code Extension
We’ve published an update on our recent security incident. See a detailed overview of what happened and our remediation steps here:
Context
The account shows how one leaked vendor key let an attacker reach coding agent traces, internal tools and an extension marketplace that developers trust.
On October 29, Cursor said it was investigating a security incident and a malicious, unauthorized copy of Anthropic's Claude Code extension in the Cursor VS Code extension marketplace. On November 13 it published a fuller account of the attack and its remediation. Cursor says it believes the incident is contained and that the last attacker activity it saw, on November 1, was blocked.
Deep dive
Cursor says the attack started when an attacker obtained an access key Cursor had issued to Fireworks, a training and inference vendor. According to Cursor, the key was exposed by Fireworks and used to copy data from a read only storage bucket shared with the vendor. The bucket held limited coding agent traces, mostly from 2025, from sessions not in Privacy Mode that Cursor was permitted to use for model training.
Some traces contained credentials that had not been redacted. Cursor says less than 0.01% of customers had API credentials exposed, and that agent traces were exposed for fewer than 0.05% of users not using Privacy Mode. With those credentials, the attacker reached select SaaS tools and from there accessed archived source code repositories not used in production, limited support data and emails, usage metrics and contact details, summaries of some agent conversations, and some credentials users had sent to support.
On October 29 the attacker used a stolen credential to place tampered copies of the Claude Code extension, versions 2.1.312 and 2.1.313, on the cache serving Cursor's extension marketplace. Cursor says at most 5,000 users may have received the malicious build, which was available for about 11 hours. Anthropic did not publish it, Cursor says it was not a flaw in Anthropic's product, and the Open VSX source never had the malware.
Cursor says production systems, the Cursor app and its official updates, customer repositories and live inference were not affected. It moved all inference off Fireworks, rotated credentials across internal systems, rebuilt the marketplace, added secret scanning and brought in outside forensics experts.
What to expect next
Watch for a response from Fireworks on how the key was exposed, since Cursor's account places the origin there and no Fireworks statement appeared in the posts scanned. Affected teams have been told which keys to rotate, and anyone who installed the tampered extension versions is asked to follow Cursor's security notice, because uninstalling alone may not be enough. Further updates to Cursor's post, regulatory notices or customer claims would mark the next stage of the incident.