The recent compromise of Anthropic’s Claude Code extension on Cursor’s marketplace was traced back to a stolen access key. The key, initially issued to Fireworks AI, was exposed during a security breach, leading to unauthorized access to certain data.
Details of the Breach
Cursor reported that the attacker utilized the stolen key to extract information from a read-only storage bucket, which held coding agent traces from sessions not using Privacy Mode. These traces included credentials that inadvertently exposed API keys for a small fraction of customers.
The intruder leveraged these credentials to infiltrate various software-as-a-service (SaaS) tools used by Cursor. The accessed data included archived source code, limited customer support interactions, product usage details, and a few credentials shared with Cursor’s support team.
Response and Mitigation Efforts
In response to the breach, Cursor deactivated the compromised key, rotated credentials, and conducted thorough investigations to prevent further unauthorized access. They temporarily disabled internal and product services to limit exposure and collaborated with their cloud service provider to dismantle the attacker’s infrastructure.
On October 29, 2026, the attacker placed a trojanized version of the Claude Code extension in the marketplace cache, potentially impacting up to 5,000 users. Cursor acted swiftly, removing the malicious build within 11 hours and notifying affected users to revoke exposed credentials.
Broader Impact and Future Outlook
In a related incident, Uber confirmed that compromised credentials led to unauthorized access to driver license information, reportedly linked to the Fireworks AI breach. The full extent of affected users remains undisclosed.
Cursor assured that no further malicious actions have been detected post-November 1, 2026, and emphasized that users with Privacy Mode enabled were unaffected. The breach did not compromise Cursor’s production environment or any other extensions from their marketplace.
As cybersecurity threats evolve, this incident underscores the importance of robust security measures and vigilant monitoring to protect sensitive information in the digital landscape.
