Cursor says key exposed by Fireworks AI led to its breach and the malicious Claude Code extension

Cursor says the breach behind the malicious Claude Code extension in its marketplace began with an access key exposed by Fireworks AI, according to an incident update published on November 13. An attacker used the key, which Cursor had issued to Fireworks, to copy data from a read-only storage bucket the two companies used to share coding agent traces, mostly from 2025 and from sessions not in Privacy Mode.

Some of those traces held unredacted credentials, which the attacker used to reach SaaS tools used by Cursor and, from there, archived non-production source code repositories, limited customer support data, usage metrics and some credentials users had sent to support. Fewer than 0.05% of users had coding agent traces exposed, and fewer than 0.01% of customers had API credentials exposed. On October 29 the attacker used a stolen credential to place unauthorized copies of Anthropic's Claude Code extension on the cache serving Cursor's VS Code extension marketplace for about 11 hours; at most 5,000 users may have received the malicious build.

Cursor says the Cursor app, its official updates, production systems and customer code repositories were not affected, and that the last attacker activity it saw was on November 1. It has moved all inference off Fireworks and rotated every exposed credential, BleepingComputer reports. Fireworks disclosed its own breach on November 10.