Cursor Breach Traced to Exposed Fireworks AI Key; 5,000 Users at Risk

At most 5,000 Cursor users received malicious copies of Anthropic's Claude Code extension on October 29, after attackers used a compromised vendor key to reach the cache serving Cursor's VS Code extension marketplace. Cursor disclosed the root cause on Friday: an access key it had issued to Fireworks AI, its training and inference provider, was exposed on Fireworks' side.

The company's two-week investigation found the attacker used that key to copy data from a read-only storage bucket shared with Fireworks. The bucket held coding-agent traces, mostly from 2025, from sessions not run in Privacy Mode — data Cursor was permitted to use for model training. Some of those traces contained credentials that had never been redacted.

The numbers are, in Cursor's telling, contained. Fewer than 0.05% of users had traces exposed, and fewer than 0.01% of customers had API credentials exposed. Those percentages still describe a supply-chain breach that reached a live extension marketplace. Small fractions of a large developer base remain a large absolute number.

How did traces become a poisoned extension?

The credentials harvested from the traces opened doors into Cursor's SaaS tools. From there, the attacker took archived non-production source code repositories, some containing business contact details, along with limited customer support data and emails, product usage metrics, summaries of some coding-agent conversations, and credentials users had sent to Cursor's support team.

On October 29, using a credential stolen from that internal data, the attacker placed tampered copies of the Claude Code extension directly onto the cache that serves Cursor's marketplace. Versions 2.1.312 and 2.1.313 were available for roughly 11 hours. Cursor stated that Anthropic did not publish the copies, that the flaw was not in Anthropic's product, and that Open VSX — the marketplace's upstream source — never carried the malware. The compromise lived entirely in Cursor's cache layer.

BleepingComputer reported that the modified extension ran JavaScript attempting to install an attacker-controlled SSH key, enable SSH access and establish persistence. Coding errors likely prevented it from working on many Windows and macOS machines where SSH was not already present. Sloppy malware is still malware. Cursor warned that uninstalling the extension alone may not suffice and directed affected users to remediation scripts in its October 29 security notice.

What has Cursor changed?

The remediation list is long, which says something about the original exposure. Cursor has:

• Moved all inference traffic off Fireworks, revoked the vendor's key and cut its access to shared data sets
• Rotated every exposed credential, then all internal credentials as a precaution
• Rebuilt its extension marketplace
• Added secret scanning across its repositories
• Redeployed its production infrastructure

Cursor stated that production systems, the Cursor app and its official updates, release signing keys, customer code repositories and Privacy Mode data were not affected. The last attacker activity the company observed came on November 1, and it was blocked. Cursor, owned by SpaceXSI, considers the incident contained.

Is Fireworks the wider problem?

Fireworks has disclosed breaches of its own, and other customers have reported fallout. Uber said hackers stole drivers' license records through the vendor, and Notion said AI chat transcripts were exposed. Security firm Wiz has grouped a run of attacks on AI developer platforms — Railway, Northflank, Lightning AI, OpenCode and Warp — under the name "Black October."

The pattern is not subtle. AI developer platforms hold agent traces, credentials and vendor keys in unusual proximity, and attackers have noticed. A read-only bucket sounds harmless until the data inside it authenticates to something else.

For Cursor, the commercial question is whether trust in its marketplace survives the revelation that a single vendor-side key exposure cascaded into poisoned extension downloads. The company has rebuilt the cache, rotated its secrets and severed Fireworks entirely; whether enterprise customers treat that as sufficient will show in retention, not in statements.