Cursor drops Fireworks AI after a leaked vendor key let hackers steal data and plant a malicious Claude Code extension
What happened? Cursor, the AI coding editor, has published the findings of its investigation into an October security breach. It says the attack started with an access key Cursor had issued to its inference and training vendor Fireworks AI, which Fireworks exposed. The attacker used it to copy data from a shared storage bucket holding historical coding-agent traces, mostly from 2025, from users who had not turned on Privacy Mode. Some of those traces contained unredacted credentials, which let the attacker into several of Cursor's SaaS tools.
What was taken: Cursor says the attacker reached archived, non-production source code repositories, limited customer support emails, product usage metrics and contact details, summaries of some coding-agent conversations, and credentials users had sent to its support team. Fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% of customers had API credentials exposed. Cursor says production systems, its app and official updates, customer code repositories and release signing keys were not affected.
The malicious extension: On 29 October the attacker used a stolen credential to place tampered copies of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) in the cache serving Cursor's extension marketplace. Up to 5,000 users may have received the build during the roughly 11 hours it was live; Microsoft's security team found it installed a persistent SSH backdoor. Cursor stresses Anthropic did not publish the copy and it was not a flaw in Anthropic's product. The last attacker activity was on 1 November and Cursor believes the incident is contained.
Why it matters: Cursor says it has moved all inference traffic off Fireworks and cut its access to shared data, a visible commercial fallout for an inference provider that recently passed $1B in annualised revenue and has disclosed a second intrusion of its own. The episode shows how a single leaked vendor key can travel from an AI infrastructure supplier into a developer tool used by millions, and why AI coding-agent logs that capture secrets have become a prime target.
Sources: Cursor incident update
BleepingComputer
Microsoft Security
Cursor security notice (30 Oct)
