Cursor said Friday that attackers used an access key the company had issued to AI infrastructure vendor Fireworks AI to copy data from a shared storage bucket, then used stolen credentials to plant unauthorized copies of Anthropic's Claude Code extension on Cursor's Visual Studio Code marketplace cache^1,2.

The company said the key was exposed by Fireworks and used to copy historical coding-agent traces, mostly from 2025, from users who had not enabled Privacy Mode². Cursor said a small number of those traces contained unredacted credentials, and that fewer than 0.01% of customers had API credentials exposed^1,2.

From those credentials, Cursor said attackers reached some of its SaaS tools and accessed archived non-production source-code repositories, limited customer support data and email, product usage metrics and contact details, summaries of some coding-agent conversations, and credentials customers had sent to support^1,2.

Cursor said its monitoring detected unauthorized activity, after which it deactivated the Fireworks key, rotated credentials, and temporarily disabled some internal and product services^1,2. On Oct. 29, using a stolen credential, the attacker placed malicious copies of the Claude Code extension on the cache that serves Cursor's extension marketplace, Cursor said².

Cursor said Anthropic did not publish the copies and that Open VSX, the marketplace source, never had the malware^1,2. Versions 2.1.312 and 2.1.313 were available for about 11 hours before removal^1,2. Cursor estimated that at most 5,000 users who requested those cached versions that day may have received the malicious build^1,2.

BleepingComputer said the modified extension tried to install persistent SSH backdoors, collect system information, and enable remote access, and that researchers found coding errors that likely blocked the backdoor on many Windows and macOS systems where SSH was not already enabled¹.

Cursor said production infrastructure, official app releases, customer code repositories, and live inference traffic were not affected^1,2. BleepingComputer said Cursor reported coding-agent traces exposed for fewer than 0.05% of users and that those users were notified¹. Cursor said users with exposed traces were notified².

The company said it moved all inference traffic off Fireworks, rebuilt the extension marketplace, rotated exposed credentials, redeployed production infrastructure, and engaged external forensics^1,2. Cursor said the last attacker activity it observed was Nov. 1 and was blocked². Customers who installed the tampered extension versions were told to follow Cursor's remediation notice, which said uninstalling the extension alone may not be enough².