NewsCursor security incident: Fireworks key leak led to fake extensionCursor says a key Fireworks exposed let an attacker reach agent traces, support data and old repos, then push a fake Claude Code extension to up to 5,000 users.Nov 14, 2026 ยท 5 min read