Threat watch / Attack
Cursor: a key held by Fireworks AI led to stolen agent traces and a tampered Claude Code extension in its marketplace
On October 29, malicious copies of Anthropic's Claude Code extension (2.1.312 and 2.1.313, Windows and macOS) were served from the cache of Cursor's extension marketplace for about 11 hours, to at most 5,000 users. Cursor's November 13 update gives the root cause: an attacker obtained an access key Cursor had issued to its inference provider Fireworks, opened a shared storage bucket of coding agent traces, used credentials found in those traces to reach some of Cursor's SaaS tools, and then used a stolen credential to place the tampered builds on the marketplace cache.
- Sector
- Tech & SaaS
- Way in
- Supplier
- Product or vendor
- Cursor, Fireworks AI
- users who may have received the tampered extension, according to Cursor[1]
- Up to 5,000
- How it happened
- Cursor says: "An attacker obtained an access key we had issued to Fireworks. The key was exposed by Fireworks." The key opened a read-only storage bucket Cursor used to share data with Fireworks, holding coding agent traces, mostly from 2025, from sessions not in Privacy Mode. Some traces held unredacted credentials, which let the attacker reach select SaaS tools used by Cursor. Then, "using a stolen credential from the exposed data from our internal system", the attacker placed tampered copies of Anthropic's Claude Code extension directly on the cache serving Cursor's VS Code extension marketplace. Cursor says Anthropic did not publish this copy, it was not a flaw in Anthropic's product, and the marketplace source, Open VSX, never had the malware.[1] Checked 14 Nov 2026
- What was stolen
- Coding agent traces from the shared bucket, some with API credentials; select archived non-production Cursor source repositories (some with business contact details); limited customer support data and email conversations; product usage metrics and contact details; summaries of some coding agent conversations; and some credentials users had sent to Cursor support. On machines that ran the tampered extension, it sent host details (hostname, username, system, environment variable names, Git email, public IP), tried to add an attacker SSH key named "svc-telemetry", enable SSH and open a reverse tunnel, and installed persistence. Cursor says Privacy Mode data, customer code repositories, production systems and its release signing keys were not affected.[1][2] Checked 14 Nov 2026
- Who was impacted
- At most 5,000 users who requested the cached versions on October 29 may have received the malicious build; the exact number of compromised machines is not given. Fewer than 0.05% of users had agent traces exposed and less than 0.01% of customers had API credentials exposed; Cursor says it notified each of them directly, and users it did not notify were not in the affected data sets.[1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- Tampered Anthropic.claude-code 2.1.312 and 2.1.313 builds are served from Cursor's marketplace between about 2:27am and 1:35pm PT. Cursor removes them, shuts the marketplace down, rotates its keys, rebuilds it and publishes a security notice with indicators and clean-up scripts. [2]
- Cursor updates its notice with clarified indicators and affected versions, and starts notifying users and admins in the app and by email. [1][2]
- Last attacker activity Cursor has seen; it was blocked. [1]
- Cursor publishes its root cause: the access key issued to Fireworks, exposed by Fireworks. Cursor has moved all inference traffic off Fireworks, deactivated the key, cut its access to shared data sets, rotated every credential in internal use, added secret scanning and engaged external forensics experts. It believes the incident is contained. [1][3]