Cursor has identified the cause of a recent security incident involving a leaked access key from Fireworks AI. This key allowed an attacker to compromise Cursor’s marketplace by embedding backdoor extensions into Claude Code. The issue was traced back to October when the unauthorized access was first detected.
Details of the Security Breach
The compromised key granted read-only access to a shared storage bucket containing coding agent records from 2025 sessions. These records, which were outside Privacy Mode, included some credentials that had not been adequately sanitized. As a result, less than 0.05% of users had coding agent traces exposed, while API credentials were exposed for under 0.01% of customers. These figures represent different elements of the breach and not the number of users affected by malware installations.
The attacker leveraged these credentials to access several internal software services used by Cursor. Among the exposed data were archived source repositories, selected support records, and customer communications. On October 29, a stolen credential was used to inject altered Claude Code packages into Cursor’s VS Code extension marketplace cache.
Impact on Users and Systems
According to Cursor’s incident report, up to 5,000 users may have received malicious versions of the Claude Code extensions for Windows and macOS during an 11-hour window. The malicious packages, Anthropic.claude-code 2.1.312 and 2.1.313, were not published by Anthropic, and Open VSX did not host the malware, correcting earlier reports.
The technical analysis by Cyber Security News revealed that the malware included JavaScript that executed upon loading the extension. It collected host details, inserted an SSH key, and attempted to establish a reverse SSH connection. However, coding errors and lack of administrator rights impeded remote access on most systems.
Consequences of the Fireworks AI Breach
The broader implications of the Fireworks AI breach included exposure of account and billing information, incomplete model weights, and selected datasets. Fireworks’ security update mentioned unauthorized access through a cloud provider. Notably, Notion and Uber reported separate impacts, with Notion involving less than 1% of workspaces and Uber concerning personal data of U.S. drivers. These disclosures are unrelated to Cursor’s extension breach.
In response, Cursor has redirected inference traffic away from Fireworks, revoked vendor access, and strengthened its internal security measures. The company has also rebuilt its extension marketplace and redeployed production infrastructure to ensure security. The last observed attacker activity was successfully blocked on November 1.
Developers impacted by the incident should follow Cursor’s remediation guidelines. This includes checking systems for residual malware, isolating affected machines, and rotating credentials. Ensuring thorough cleanup is crucial to prevent further issues.
