Cursor breach: Fireworks AI key led to malicious Claude Code extension
Cursor says an access key exposed at AI provider Fireworks enabled a chain of data theft, credential compromise, and a trojanized Claude Code extension served through Cursor's marketplace. Up to 5,000 users may have received the malicious builds, but potential delivery does not prove every device was infected.
What happened?
Confirmed facts: Cursor published a detailed incident update on November 13, 2026 explaining how an attacker reached internal data and later placed malicious copies of Anthropic's Claude Code extension in Cursor's VS Code extension marketplace. Cursor says an access key it had issued to AI infrastructure provider Fireworks was exposed there. The attacker used the key to copy data from a read-only storage bucket Cursor used to share historical coding-agent traces with Fireworks. The traces were mostly from 2025 sessions that were not in Privacy Mode and could be used for model training. Cursor says fewer than 0.05% of users had traces exposed and fewer than 0.01% of customers had API credentials exposed because some credentials had not been redacted. The attacker then used credentials found in the data to reach selected SaaS tools and access archived non-production source repositories, limited support data and email conversations, product-usage metrics and contact information, summaries of some coding-agent conversations, and some credentials users had sent to support. On October 29, a stolen internal credential was used to place tampered versions 2.1.312 and 2.1.313 of Anthropic.claude-code directly in the cache serving Cursor's extension marketplace. Cursor says the malicious builds were available for about 11 hours and that at most 5,000 users who requested those cached versions may have received one. Anthropic did not publish the tampered builds, Anthropic's systems were not identified as compromised, and Open VSX did not host the malware. Microsoft independently analyzed a malicious artifact and confirmed code intended to collect host information, install an SSH key, enable remote access, create a reverse tunnel, and establish persistence. Cursor says it removed the builds, rebuilt the marketplace, rotated credentials, redeployed production infrastructure, moved inference away from Fireworks, notified affected users, and blocked the last attacker activity it observed on November 1. What remains unresolved: Cursor has not publicly identified the attacker, disclosed how many of the potentially exposed devices successfully executed every backdoor stage, or established that every person who requested an affected version was infected. Fireworks says its broader investigation remains active, and Cursor's report does not publicly map the exposed key to one specific Fireworks intrusion event. Potential delivery to 5,000 users is an upper-bound exposure estimate, not a confirmed infection count.
How the technology works
At a safe defensive level, this was a multi-stage software supply-chain incident. A vendor-held access key opened a shared storage location. Historical AI-agent traces in that location contained a small number of unredacted secrets. Those secrets provided access to additional services, where another credential capable of modifying the marketplace delivery cache was obtained. The attacker then substituted a malicious extension for particular cached versions of a trusted developer tool. When loaded, the altered package could run code with the developer's permissions and attempt to create persistent remote access. The risk extended beyond the editor because developer computers often hold source-code access, cloud sessions, signing credentials, API keys, SSH keys, and production-management tools. This article intentionally omits the attacker's key, server locations, payload code, persistence paths, command syntax, and other operational details. Microsoft cautions that the observed sequence describes attempted capabilities and does not prove each stage succeeded on every host.
Who is affected?
The most directly affected users are people who installed or updated Anthropic.claude-code versions 2.1.312 or 2.1.313 from Cursor's own extension marketplace between approximately 2:27 a.m. and 1:35 p.m. Pacific time on October 29. Users who obtained Claude Code from Microsoft's Visual Studio Marketplace, npm, Anthropic, or Open VSX are not included in Cursor's identified marketplace exposure. Cursor says users who enabled Privacy Mode did not have prompts or code included in the exposed historical traces. It also says its official app and updates, release-signing keys, production systems, customer code repositories, active inference traffic, other marketplace extensions, and other plugins were not affected. Customers whose historical traces, API credentials, support information, or other data were involved should have received direct notice from Cursor. However, absence from the extension-delivery window does not automatically resolve a separate direct notification about exposed data or credentials.
What should you do?
If you installed or updated the affected Claude Code versions from Cursor's marketplace during the October 29 window, treat the endpoint as potentially compromised. Follow Cursor's official security notice, isolate any host showing relevant evidence, preserve endpoint and network logs, and involve qualified incident responders. Uninstalling the extension alone may not remove standalone persistence. Rebuild a confirmed-compromised developer workstation from a trusted image when integrity cannot be established. From a known-clean device, revoke active sessions and rotate credentials that were accessible from the affected host, prioritizing source-control, cloud, deployment, package-registry, SSH, VPN, email, identity, password-manager, and API credentials. Review account logs for unfamiliar access, new keys, tokens, users, automation, repository changes, releases, or infrastructure actions. Team administrators should compare extension-installation records and endpoint telemetry with Cursor's official exposure window and notifications. If Cursor directly identified a specific exposed API credential, rotate that credential even when no malicious use is visible. Development organizations should prohibit secrets in prompts, agent traces, support tickets, screenshots, logs, and training datasets; use automated secret scanning before data leaves a trust boundary. Give vendors short-lived, narrowly scoped credentials, restrict them by network and workload identity where possible, separate training data from production access, and require rapid revocation. Extension marketplaces should use immutable signed artifacts, independent publisher verification, protected cache writes, reproducible provenance, and alerts on any package replacement. Individuals who did not use the affected Cursor marketplace versions and did not receive a direct notice should not assume their device was infected solely because they use Claude Code.
My analysis
My Analysis - opinion and inference: this incident is a warning about data reuse, not just marketplace security. Historical AI traces were valuable enough to train models but sensitive enough to carry credentials into a vendor-controlled storage path. Once one secret escaped, the attacker moved through several layers of delegated trust until a developer tool became the delivery mechanism. My inference is that AI infrastructure will remain a high-value supply-chain target because providers accumulate prompts, traces, code context, model artifacts, API keys, and privileged integrations from many customers. That is a defensive risk assessment, not attribution of this attack. Cursor deserves credit for publishing the chain, naming the affected versions, separating unaffected systems, and notifying users, but the security model failed at multiple points: secrets were not reliably removed from traces, vendor access was not sufficiently constrained, credentials found in secondary systems remained usable, and a marketplace cache could serve altered code. From a privacy-first viewpoint, Privacy Mode should be the default rather than an option users must discover. Training use should require informed choice, strict minimization, automatic secret removal, short retention, and an enforceable deletion path. Support teams should never ask users to paste live credentials, and any credential sent accidentally should be automatically detected, quarantined, and revoked. Vendors should publish retention periods, subprocessors, access boundaries, and independent audit results so customers can judge the real cost of sharing development data. Security telemetry should focus on artifact integrity, access, secret use, and configuration changes, not indefinite collection of developer prompts or source code.
Why this matters
Cyber incidents often sound distant or overly technical. The important question is whether the same weakness, behavior, surveillance power, or exposure exists in systems you use. Facts and opinion are separated here so you can judge both clearly.
Facts, claims, and unknowns are separated above. Details may change as investigations and official statements develop.
Cursor: update on the recent security incident Cursor: malicious Claude Code extension security notice Fireworks AI: October 2026 security incident update Microsoft Security: analysis of the malicious Claude Code-branded extension BleepingComputer: Cursor confirms breach led to malicious Claude Code extension The Hacker News: stolen Fireworks AI key led to Cursor incident