Overview
Cursor has confirmed a security breach that began with credentials stolen from AI infrastructure provider Fireworks AI. The attackers used them to copy data from a storage bucket Cursor shared with Fireworks and later to publish malicious copies of Anthropic's Claude Code extension through Cursor's VS Code marketplace.
This is a new development in the Fireworks AI incident we covered earlier: Fireworks AI Breach Widens to Customer Datasets, Model Weights and Notion AI Chats.
What happened
- Data exposure: An exposed access key let attackers read a read-only bucket shared with Fireworks. It held historical AI coding-agent traces, mostly from 2025, from users who did not have Privacy Mode enabled. Some traces contained unredacted API credentials, which gave the attackers a path into further Cursor systems.
- Malicious extension: On October 29, a stolen credential was used to place trojanized Claude Code extension versions 2.1.312 and 2.1.313 on the cache that serves Cursor's marketplace. They were live for about 11 hours before removal.
- Not affected: Anthropic's legitimate extension and the Open VSX registry were not compromised.
The payload
The modified extension ran JavaScript that tried to install persistent SSH backdoors. It collected system information, added an attacker-controlled SSH key, attempted to enable SSH, and set up persistence. Coding errors reportedly stopped it from working on many Windows and macOS systems where SSH was not already enabled, which likely limited the real-world damage.
Scale
| Item | Figure |
|---|---|
| Users who may have received the malicious builds | Up to 5,000 |
| Users with coding-agent traces exposed | Fewer than 0.05% |
| Customers with API credentials compromised | Fewer than 0.01% |
| Exposure window for malicious extension | About 11 hours (Oct 29) |
Other data taken includes archived non-production source repositories, limited support emails, product usage metrics and contact details, summaries of some AI agent conversations, and credentials customers had shared with support.
Cursor's response
Cursor revoked the Fireworks key, rotated exposed credentials, temporarily shut down some internal and product services, moved all inference traffic away from Fireworks, rebuilt its extension marketplace, and redeployed production infrastructure as a precaution. It says production infrastructure, official app releases, customer code repositories, and code and prompts from Privacy Mode users were not affected.
BleepingComputer links the incident to a wave of attacks on AI developer platforms that Wiz calls "Black October", aimed at stealing credentials for AI model access. Related incidents involved Railway, OpenCode, Warp and Fireworks AI.
Recommended actions
- Check whether Cursor installed or updated the Claude Code extension on October 29, and look for versions 2.1.312 or 2.1.313.
- If so, inspect
~/.ssh/authorized_keysfor keys you did not add, check whether the SSH service was enabled, and review persistence mechanisms such as launch agents, services and cron entries. - Rotate any API keys or secrets that appeared in agent sessions, prompts or files while Privacy Mode was off.
- Enable Privacy Mode and avoid pasting credentials into AI coding sessions.
- Follow Cursor's official remediation guidance for affected users.