Cursor has confirmed that an access key issued to Fireworks AI was accidentally exposed in October, triggering a chain of events that led to a serious security breach. The exposed key gave read-only access to a shared storage unit containing code agent data. Some of these records also included API credentials that had not been stripped out.
Though the number of impacted users is small—Cursor estimates fewer than 0.05% had coding agent traces exposed, and under 0.01% of customers had API credentials compromised—the effects were significant. The attacker leveraged leaked credentials to infiltrate internal tools and services. Sensitive information like support emails, usage metrics, contact details, conversation summaries, archive files, and non-production source repositories were accessed. Cursor insists model training data stored in Privacy Mode and official updates remained secure.
Backdoored Claude Code Extensions Discovered
On October 29, following the credential leak, the attacker pushed malicious versions of the Claude Code VS Code extension directly into Cursor’s marketplace cache. These versions—Anthropic.claude-code 2.1.312 and 2.1.313—for Windows and macOS may have been downloaded by up to 5,000 users over an approximately 11-hour window. Importantly, this figure reflects the potential reach, not confirmed successes.
The tampered extensions included JavaScript payloads designed to run immediately upon load—no Claude conversation needed. Among the malicious actions: collecting host information, injecting an SSH key named “svc-telemetry,” and attempting to establish a reverse SSH tunnel with a remote server. On macOS, a LaunchAgent was used, and on Windows, a scheduled task with fallback methods ensured persistence. Although many attempts were blocked by misconfigurations or lack of administrative permissions, data collection and some changes still occurred.
Broader Fireworks AI Fallout and Response Steps
The Cursor breach is just one aspect of a larger Fireworks AI security issue, which has also exposed account and billing details, select data sets, and incomplete AI model weights. Fireworks says different clients experienced varying degrees of exposure. Other companies, including Notion and Uber, disclosed related but distinct impacts—such as leaked transcripts or driver’s information—but those disclosures did not involve Cursor’s app marketplace.
Cursor has taken emergency countermeasures: cutting inference traffic to Fireworks, revoking vendor access, rotating credentials, rebuilding its extension marketplace, and reinforcing internal monitoring. The company believes threat activity ceased by November 1. It’s urging affected users not only to uninstall the corrupted extensions, but to scan and remove leftover SSH keys, examine startup scripts, isolate machines, rotate credentials from secure systems, and assess whether a full rebuild is necessary.
This breach is a wake-up call: a single leaked vendor key can expose vast swaths of internal systems, especially when credentials linger in accessible logs. Developers should assume that just removing an extension may not clean up all residual risks. As companies outsource components or grant third-party access, rigorous credential hygiene becomes non-negotiable and continuous inspection of code dependencies and vendor relationships needs to be baked in.
