AI coding tool maker Cursor has published an updated account of its October security incident, tracing the breach back to a single access key exposed by third-party AI infrastructure vendor Fireworks AI — and showing how that one leaked credential snowballed into backdoored versions of the Claude Code extension reaching Cursor’s own users.

From a Read-Only Storage Key to a Marketplace Compromise

According to Cursor’s November 13 update, the attacker obtained a key that Fireworks AI had issued to Cursor, granting read-only access to a shared storage bucket. That bucket held historical coding-agent session traces, mostly from 2025, drawn from sessions outside Privacy Mode that Cursor was contractually permitted to use for model training. The problem: some of those archived records contained credentials that had never been scrubbed out.

Cursor says fewer than 0.05% of users had coding-agent traces exposed through the bucket, and fewer than 0.01% of customers had API credentials exposed — figures that describe two different slices of the incident and should not be read as the number of users who ultimately received malicious software.

Using credentials recovered from those exposed records, the attacker pivoted into other software services Cursor relies on, reaching archived non-production source repositories, limited support records and emails, usage metrics, contact details, conversation summaries, and some credentials that customers had themselves submitted to Cursor support.

How the Backdoor Reached Users

On October 29, a credential obtained through that chain let the attacker insert modified Claude Code extension packages directly into the cache serving Cursor’s VS Code extension marketplace. Cursor is explicit that Anthropic never published these packages, that Anthropic’s own product was not vulnerable, and that the open-source Open VSX registry never hosted the malicious files — correcting earlier reporting that had suggested otherwise.

By Cursor’s estimate, at most 5,000 users who requested specific cached extension versions during a roughly 11-hour window could have received the tampered builds — packages identified as versions 2.1.312 and 2.1.313 for Windows and macOS. Independent technical analysis found that the backdoor ran injected JavaScript the moment the extension loaded, with no need to open a Claude conversation. On execution, it:

• Collected host and environment details, including environment variable names (not their values)
• Added an attacker-controlled SSH key labeled svc-telemetry
• Attempted a reverse SSH tunnel to a hardcoded external IP address
• Established persistence via a macOS LaunchAgent or a Windows scheduled task with a Startup-folder fallback, retrying its connection roughly every 60 seconds

Cursor says coding errors and missing administrator privileges blocked remote login on most affected hosts, though that did not stop the backdoor from collecting data or making other changes before being blocked.

A Breach With Several Downstream Victims

The Fireworks AI breach itself appears to have had a wider blast radius, with Fireworks’ own disclosure describing exposure of account and billing records, select datasets, and incomplete model weights, reportedly through a cloud provider hosting its development machines. Separately, Notion disclosed that AI chat transcripts used by its Insights feature were exposed across fewer than 1% of workspaces, and Uber disclosed a breach involving driver’s license information for thousands of U.S. drivers. Cursor and the other companies are clear that none of these disclosures establishes a direct link to the Claude Code extension attack specifically.

Cursor’s Response

Cursor says it has moved inference traffic away from Fireworks AI, revoked the vendor’s access, rotated internal credentials, rebuilt its extension marketplace cache, and expanded secret scanning and network egress restrictions, in addition to redeploying production infrastructure as a precaution. The company believes the incident is now contained, with the last observed attacker activity on November 1 successfully blocked.

For developers who may have installed one of the affected versions, Cursor’s guidance is that uninstalling the extension alone is not sufficient — SSH keys and startup scripts planted by the backdoor can remain behind. Affected users are advised to review endpoint evidence, isolate potentially compromised machines, manually remove any added persistence mechanisms, rotate credentials from a separate trusted device, and evaluate whether a full rebuild of the affected system is warranted.