Cursor confirms breach: stolen Fireworks AI key led to trojanized Claude Code extension

Cursor, the AI-powered code editor, confirmed that a security breach allowed attackers to publish a trojanized copy of Anthropic's Claude Code extension through its marketplace, potentially exposing up to 5,000 developers to malware that installed persistent SSH backdoors.

The company disclosed the findings in an incident report published Friday, following an investigation that began after the malicious extension surfaced on October 29.

How the attack unfolded

According to Cursor, the attack began at Fireworks AI, a third-party provider used for AI model training and inference. An attacker obtained an access key that Cursor had issued to Fireworks; the key was exposed by Fireworks, and the attacker used it to copy data from a read-only storage bucket Cursor shared with the vendor.

That bucket contained limited coding-agent traces, mostly from 2025, from sessions not in Privacy Mode, which Cursor was permitted to use for model training. A small number of those traces contained credentials that had not been redacted. Cursor said fewer than 0.01% of customers had API credentials exposed.

Starting from those credentials, the attacker reached select software-as-a-service tools used by Cursor. From these, Cursor said, the attacker accessed archived non-production source code repositories, some containing business contact information; limited customer support data and email conversations; product usage metrics and contact details; summaries of some coding-agent conversations; and some credentials users had sent to the support team.

Cursor said fewer than 0.05% of users had coding-agent traces exposed.

The malicious extension

On October 29, using a stolen credential from the exposed internal data, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace.

Cursor stressed that Anthropic did not publish the copy and that the issue was not a vulnerability in Anthropic's product. The marketplace's upstream source, Open VSX, never had the malware.

At most 5,000 users who requested specific cached versions of the extension on October 29 potentially received the malicious build. It was available for approximately 11 hours before Cursor removed it, took the extension marketplace offline, and worked with the cloud provider hosting the attacker's server to shut it down.

Response and notification

Cursor said its monitoring systems detected the unauthorized activity. It deactivated the vendor's key, opened an incident response workstream, and revoked and rotated credentials. As a precaution, it temporarily disabled internal and product services, disrupting certain Cursor features before restoring them.

On October 30, the company published a security notice with indicators of compromise and remediation steps, and began notifying affected users and team administrators. Cursor said the vast majority of customers were not affected and that it has contacted each affected customer directly.