Coding is Love
News 5 min read

Cursor security incident: Fireworks key leak led to fake extension

Cursor published the findings of its two-week investigation into its October security incident on November 13, 2026: an attacker used an access key that Cursor had issued to its AI vendor Fireworks, and that Fireworks exposed, to copy stored coding agent traces, then used credentials found inside them to reach Cursor’s SaaS tools and push a malicious copy of Anthropic’s Claude Code extension to Cursor’s extension marketplace. Cursor says the vast majority of customers were not affected, at most 5,000 users may have received the tampered extension, and it has contacted every affected customer directly. If you use Cursor and installed Claude Code from its marketplace on October 29, read the remediation steps below. The details are in Cursor’s update on the security incident.

What happened

Cursor lays out the attack in four steps:

  • It started at Fireworks. The attacker obtained an access key Cursor had issued to Fireworks, which Fireworks exposed, and used it to copy data from a read-only storage bucket Cursor used to share data with the vendor. The bucket held limited coding agent traces, mostly from 2025, from sessions not in Privacy Mode that Cursor was permitted to use for model training.
  • Credentials in those traces opened more doors. Some traces contained credentials that had not been redacted; Cursor says less than 0.01% of customers had API credentials exposed. With them the attacker reached “select SaaS tools used by Cursor” and accessed archived non-production source code repositories (some with business contact information), limited customer support data and email conversations, product usage metrics and contact details, summaries of some coding agent conversations, and some credentials users had sent to Cursor’s support team.
  • A fake Claude Code extension went out. On October 29, with a credential stolen from that data, the attacker placed malicious copies of Anthropic’s Claude Code extension directly on the cache that serves the Cursor VS Code extension marketplace. Cursor stresses that Anthropic did not publish this copy, that it was not a flaw in Anthropic’s product, and that Open VSX, the marketplace’s source, never had the malware. The bad build was live for about 11 hours, and at most 5,000 users who requested the specific cached versions may have received it.
  • Contained by November 1. Cursor says the last attacker activity it saw was on November 1, and it was blocked.

According to Cursor’s October 29 security notice, the tampered versions were Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS, available between about 2:27am and 1:35pm PT. The payload collected host and user details (hostname, username, OS, environment variable names, Git email, public IP), added an attacker SSH key labeled svc-telemetry to authorized_keys, tried to open a persistent reverse SSH tunnel through a LaunchAgent on macOS or a scheduled task on Windows, and retried roughly every 60 seconds. Cursor says turning on the local SSH service needs admin rights the extension did not have on most machines, so that step usually failed, and the attacker’s server has since been taken offline.

What was not affected

Cursor lists what the attacker did not reach:

Not affected Cursor’s note
Prompts and code in Privacy Mode Not in the exposed traces
Users outside Privacy Mode Traces exposed for fewer than 0.05% of users, all notified directly
Live traffic and active inference requests Exposed data was historical offline-analysis storage; inference moved off the vendor
Production systems and the Cursor app Cursor ships from a separate code host the attacker never accessed; no release signing keys exposed
Other marketplace extensions and plugins Validated as authentic; the marketplace store was rebuilt
Customer code repositories Not accessed

Cursor says that if you did not get a notification, your data was not in the exposed traces.

What Cursor has done

Cursor moved all inference traffic off Fireworks, deactivated the key and cut off the vendor’s access to every shared data set. It rotated every exposed credential it found and, as a precaution, all credentials across its internal systems; restricted network access at its service providers where possible so stolen credentials can’t be used from elsewhere; added secret scanning to all its code repositories and other internal data; redeployed its production infrastructure; and brought in external forensics experts. During the response it also temporarily switched off internal and product services, which disrupted some Cursor features for a while.

What it means for developers

  • Check your machine if you use Claude Code in Cursor. If you installed or updated to version 2.1.312 or 2.1.313 from the Cursor marketplace on October 29, run the check from the security notice. On macOS: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". If the key is there, use Cursor’s remediation scripts (remediate-macos.sh or remediate-windows.ps1), remove persistence and the SSH key, and rotate credentials reachable from that machine, from a trusted system. Cursor warns that uninstalling the extension alone may not be enough.
  • Rotate what your admins were told to rotate. Where credentials were exposed, Cursor emailed team admins a list of the specific keys and asked the services that issued them to revoke them.
  • Don’t paste secrets into agent sessions or support tickets. The whole chain began with unredacted credentials sitting in coding agent traces, and part of what was taken was credentials users had sent to support. Use scoped, short-lived tokens, and prefer Privacy Mode for work on sensitive code.
  • Vendors are part of your attack surface. This breach started at an inference vendor, not at Cursor’s own infrastructure. The same lesson applies to any tool you send code or traces to. For keeping your other developer tools patched, see our post on the Git 2.56.1 security fixes.

Cursor apologized to those affected and says it will update its post if anything important changes. Questions go to [email protected].

Sources