Cursor has traced its October security breach to an access key exposed by Fireworks AI, the inference vendor it has now cut off, the company said in an incident update published on November 13. The attacker used the key to copy coding agent traces, steal credentials, and plant a backdoored copy of Anthropic’s Claude Code extension that may have reached up to 5,000 users. Cursor says it believes the incident is contained, with the last attacker activity seen on November 1.

The update closes the loop on an incident Cursor first disclosed on October 29, when a malicious copy of the Claude Code extension appeared in its VS Code extension marketplace. GPTOnline covered the initial disclosure at the time. Two weeks of investigation have now answered the question Cursor could not answer then: how the attacker got in.

What happened

“It started at Fireworks,” Cursor wrote. An attacker obtained an access key Cursor had issued to Fireworks, and the key was exposed by Fireworks. The attacker used it to copy data from a read-only storage bucket the two companies used to share data. That bucket held limited coding agent traces, mostly from 2025, from sessions not in Privacy Mode, which Cursor was permitted to use for model training. A small number of those traces contained credentials that had not been redacted. Cursor puts the exposure at fewer than 0.05% of users for traces and less than 0.01% of customers for API credentials.

Starting with those credentials, the attacker reached select software tools used by Cursor. From there, they accessed archived non-production source code repositories, limited customer support data and email conversations, product usage metrics and contact details, summaries of some coding agent conversations, and credentials users had sent to the support team.

“This incident involved data we stored and shared, credentials we issued, and systems we operate,” Cursor wrote, adding that it is addressing the impact and strengthening its security based on what it learned.

How the Cursor incident unfolded, from the malicious extension on October 29 to the root cause update on November 13.
How the Cursor incident unfolded, from the malicious extension on October 29 to the root cause update on November 13. Graphic: GPTOnline, based on Cursor’s incident update.

The backdoored extension

On October 29, using a credential stolen from the exposed internal data, the attacker placed malicious, unauthorized copies of Anthropic’s Claude Code extension directly on the cache that serves the Cursor VS Code extension marketplace. The tampered versions were Anthropic.claude-code 2.1.312 and 2.1.313, for Windows and macOS. At most 5,000 users who requested specific cached versions potentially received the malicious build, which was available for about 11 hours before Cursor removed it.

Cursor stressed that Anthropic did not publish the copy, that the incident was not a vulnerability in Anthropic’s product, and that the marketplace source, Open VSX, never hosted the malware. Cursor took the extension marketplace offline and worked with the cloud provider hosting the attacker’s server to take it down.

On October 30, Cursor published a security notice with indicators of compromise, remediation steps, and scripts to check affected systems, and began notifying affected users and team administrators through in-app notices and email. Customers who installed or updated to the tampered versions during the exposure window should follow the steps in that notice. Cursor warned that uninstalling the extension alone may not be enough.

The scale of the incident, as reported by Cursor.
The scale of the incident, as reported by Cursor. Graphic: GPTOnline, based on Cursor’s November 13 update.

What was not affected

Cursor listed the systems and data it says stayed safe: prompts and code for users in Privacy Mode; any data or live traffic customers are sending to Cursor now; the production systems and infrastructure that run Cursor; the Cursor app and its official updates; and customer code repositories. No release signing keys were exposed, and no other extension in the marketplace was affected. Cursor said it validated that all other extensions were authentic and reviewed and rebuilt the marketplace store.

What Cursor has done

Cursor said it has moved all inference traffic off Fireworks, deactivated the key it had issued to the vendor, and cut off Fireworks’ access to all data sets the two companies shared. It rotated every exposed credential it found, highest risk first, and as a precaution rotated all credentials in use across its internal systems, even where it had no evidence of exposure. The company also expanded secret scanning across its code repositories and other internal data sources, expanded network access restrictions, redeployed all production infrastructure, and engaged external forensics experts.

The company believes the incident is contained. “The last attacker activity we have seen was on November 1, and it was blocked,” Cursor wrote. Monitoring continues, and the company said it will contact customers directly if it identifies additional information that affects them.

Why it matters

The update turns a marketplace compromise into a supply chain lesson. The entry point was not Cursor’s own code or Anthropic’s extension, but a vendor access key and a shared data bucket holding coding agent traces. Those traces are a sensitive data class: they can contain API keys and credentials that developers paste into agent sessions, and in this case a small number did.

The incident also connects to Fireworks AI’s own breach disclosures. GPTOnline previously reported that Fireworks AI disclosed a second hack in weeks, with customer data exposed. Fireworks has published its own account of an October incident on its security bulletins page, which Cursor linked in its update. Cursor does not say when the key was exposed, so the timeline before October 29 remains open.

For Cursor users, the practical takeaway is narrow but urgent: anyone who installed Claude Code 2.1.312 or 2.1.313 from the Cursor marketplace on October 29 should follow Cursor’s remediation steps, even if they have since uninstalled the extension.

Sources