Essential Insights
- Fireworks AI breach exposed Cursor data: A stolen vendor key let attackers access coding-session traces and credentials, affecting API credentials for fewer than 0.01% of Cursor customers.
- Stolen credentials enabled wider access: Attackers reached select Cursor SaaS tools and accessed limited support, usage, contact, and internal repository data.
- Claude Code extension was trojanized: Up to 5,000 users may have received a malicious version on October 29; it was available for about 11 hours and attempted to install an SSH backdoor.
- Cursor says the threat is contained: It revoked credentials and cut ties with Fireworks; no activity has been detected since Nov. 1. Uber and Notion also reported data exposure linked to the provider.
A Stolen Key Opened a Path to the Extension Attack
Cursor says an attacker used an access key exposed during a breach involving Fireworks AI to copy data from a storage bucket. Cursor had shared the bucket with the AI company. The attacker then used credentials found in the copied data to reach some of Cursor’s business tools.
The bucket held limited records from coding-agent sessions that took place mostly in 2025. Cursor says those sessions did not use Privacy Mode and could be used for model training. Some records contained credentials that had not been removed. Fewer than 0.01% of Cursor customers had API credentials exposed, the company said.
On October 29, the attacker used a stolen credential to place altered versions of Anthropic’s Claude Code extension in Cursor’s marketplace cache. The malicious versions could install a persistent backdoor that lets an attacker maintain access to a computer. Up to 5,000 users who requested specific cached versions may have received the files during an 11-hour window. Cursor says it found no evidence of further malicious activity after November 1.
What the Incident Means for AI Coding Tools
Cursor removed the extension, took its marketplace offline, and worked with a cloud provider to shut down the attacker’s server. It also revoked credentials, moved its AI processing away from Fireworks, and contacted users who installed versions 2.1.312 or 2.1.313 during the exposure window.
The company says it found no evidence that Privacy Mode users, customer code repositories, or Cursor’s production systems were affected. Still, the incident shows how a breach at one service provider can reach other companies through shared keys and software channels.
AI coding tools can help people build and review software faster. As more teams adopt them, companies must protect credentials and carefully check the updates they distribute. Those safeguards can help people benefit from AI without losing control of their data or devices.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
DataProtection-V1
