Cursor Traces October Breach to Fireworks AI Key as Fake Claude Code Extension Reached Up to 5,000 Users

Two weeks after a tampered copy of Anthropic's Claude Code extension turned up in its extension marketplace, Cursor has published its account of how the attack unfolded — and the trail leads back to one of its own vendors. In an update posted on 13 November, the AI code editor company says the intrusion began with an access key it had issued to Fireworks AI, an inference provider it used to run AI models.

The disclosure connects the dots between two incidents that, until now, had been reported separately: the October breach at Fireworks AI, and the malicious Claude Code builds that appeared in Cursor's marketplace on 29 October. Cursor says it has contacted every affected customer directly, and that the incident is contained — the last attacker activity it has seen was on 1 November, and it was blocked.

How a vendor key became a marketplace attack

According to Cursor's investigation, the chain of events ran in five steps. First, an attacker obtained an access key Cursor had issued to Fireworks, which Cursor says was exposed by Fireworks. The attacker used that key to copy data from a read-only storage bucket the two companies used to share data. That bucket held limited coding-agent traces, mostly from 2025, drawn from sessions that were not in Privacy Mode and which Cursor was permitted to use for model training.

A small number of those traces contained credentials that had not been redacted. Cursor puts the exposure at fewer than 0.01 percent of customers for API credentials, and fewer than 0.05 percent of users for coding-agent traces. Starting from those credentials, the attacker reached some of the software-as-a-service tools Cursor uses, and from there accessed archived non-production source code repositories, limited customer support data and email conversations, product usage metrics and contact details, summaries of some coding-agent conversations, and credentials users had sent to the Cursor support team.

On 29 October, using a stolen credential taken from that internal data, the attacker placed malicious, unauthorised copies of Anthropic's Claude Code extension — versions 2.1.312 and 2.1.313 — directly on the cache that serves Cursor's VS Code extension marketplace. The tampered builds were available for about 11 hours, from 2:27 a.m. to 1:35 p.m. Pacific Time, before Cursor removed them. Cursor says at most 5,000 users who requested those cached versions on 29 October potentially received the malicious build.

Cursor is emphatic about what did not happen here. Anthropic did not publish the malicious copies, and the incident was not a vulnerability in Anthropic's product. The marketplace's upstream source, Open VSX, never carried the malware. Anthropic's Felix Rieseberg said the company is working with Cursor on the incident, but that it was not a compromise of Anthropic's systems or employee laptops.

What the fake extension did

Analysis of the tampered build, reported by BleepingComputer, found that it ran malicious code as soon as the extension loaded, with no click needed from the user. It collected the username, computer name, public IP address and Git email from the machine, then tried to add the attacker's own SSH key, switch on remote login and keep a tunnel open back to the attacker.

That is why Cursor's warning to anyone who installed or updated to version 2.1.312 or 2.1.313 from its marketplace during the window is blunt: uninstalling the extension alone may not be enough. Cursor published a security notice on 30 October with indicators of compromise, remediation steps and scripts to check a system, and users who had the tampered versions should follow those steps. Coverage of the notice points to version 2.1.314 as the clean build to move to.

Who was affected — and who was not

Cursor says the vast majority of customers were not affected. Prompts and code from users with Privacy Mode switched on were not exposed, and neither were customer code repositories, the production systems that run Cursor, the Cursor app and its official updates, or any release signing keys. Active inference requests were not exposed, and no other extension in the marketplace was affected — Cursor says it validated that every other extension was authentic and has reviewed and rebuilt the store.

The company also says it emailed team administrators a list of the specific keys to rotate where credentials were exposed, and asked the third-party services that issued those credentials to revoke them. Customers whose support or business data may have been involved were notified directly. If you did not receive a notification, Cursor says your data was not in the exposed traces.

What Cursor has done since

Cursor says it has moved all inference traffic off Fireworks, deactivated the key it had issued to the vendor, and cut off its access to every data set the two companies shared. It rotated every exposed credential it found, highest risk first, and as a precaution rotated all credentials in use across its internal systems, even where it had no evidence of exposure. It also redeployed all production infrastructure and services, expanded network access restrictions across its service providers, added secret scanning across its code repositories, and brought in external forensics experts.

One attribution note matters. That the key was exposed by Fireworks is Cursor's account. Fireworks' own security bulletins page, last updated on 9 November, does not mention Cursor, and it is not public which of Fireworks' two October intrusions exposed the key. Fireworks has disclosed two intrusions — one detected on 6 October, and a second on 23–24 October through a third-party cloud provider.

A breach still being mapped, company by company

Cursor was not the only company to publish an incident report on 13 November. Apify and Epoch AI published their own the same day, a sign that the Fireworks breach's blast radius is still being mapped, company by company. The Cursor disclosure is the third Fireworks fallout angle to reach Innopark IT readers: an earlier breach at the same vendor exposed Notion AI chat transcripts, and a later disclosure confirmed hackers stole thousands of Uber drivers' licence details.

The episode is also a reminder of how far a single leaked credential can travel. A key issued to a vendor, copied traces that still held unredacted secrets, and a marketplace cache that did not check who had published the build — each link in that chain was small on its own, and together they put a booby-trapped extension in front of thousands of developers.

Sources

• Cursor — An update on our recent security incident (13 November 2026)
• iFynx — Cursor Security Breach: Fireworks Key and Fake Claude Code Extension (14 November 2026)
• Dev.to — Your agent traces are a secret store: notes on the Cursor, Apify and Epoch AI incident reports
• AI Frontier Post — Cursor traces its tampered Claude Code extension to the Fireworks AI breach (14 November 2026)

Related Innopark IT coverage: Notion AI chat transcripts exposed in Fireworks AI breach and Uber drivers' licence data stolen in Fireworks AI breach.