Cursor has shared what its two-week look into the Cursor breach found: an attacker slipped a tampered Claude Code extension into its marketplace on October 29. In a November 13 update, the AI code editor says up to 5,000 people may have downloaded it, and some customer data was also taken.
This matters because the attack chain began at a third-party AI vendor, Fireworks AI, and then spread into the tools developers rely on every day. If you use Cursor, especially without Privacy Mode, it is worth checking whether the company contacted you and whether your machine picked up the fake extension.
At a Glance
- An access key Cursor had given to Fireworks AI was exposed and used to copy stored coding agent traces.
- Fake Claude Code versions 2.1.312 and 2.1.313 sat in Cursor’s marketplace for about 11 hours on October 29.
- Cursor says at most 5,000 users may have received the malicious build on Windows or macOS.
- Cursor believes the incident is contained, with the last attacker activity blocked on November 1.
How the Attack Unfolded
Cursor says the trouble began at Fireworks AI, a vendor it used to train and run models, which exposed a key Cursor had handed it. The attacker used the key to pull files from a shared storage bucket. Those files were logs of older AI coding sessions, largely from last year, where Privacy Mode had been switched off.
A few of those logs still held secret keys that had never been scrubbed. Cursor puts the share of customers whose API keys leaked this way at under 0.01%. With those keys, the attacker got into several outside software services Cursor uses for its business.
From there, the attacker reached archived source code that was not used in production, some customer support emails, product usage numbers, contact details, summaries of certain coding agent chats, and credentials that users had shared with Cursor support staff. Under 0.05% of users had their session logs exposed, the company says.
The Fake Claude Code Extension
On October 29, the attacker used a stolen login key to plant altered builds of the Claude Code add-on, which Anthropic makes, in the cache behind Cursor’s extension store. Cursor stresses that Anthropic did not publish these copies and that this was not a flaw in Anthropic’s product. Open VSX, the source behind the marketplace, never carried the malware.
Cursor’s earlier notice says the fake add-on collected the computer’s name, the user name and the public IP address. It then tried to plant the attacker’s SSH key, turn on remote login and keep a hidden tunnel alive.
Cursor says the remote login step usually failed because it needs admin rights. The attacker’s server has also been shut down.
What Cursor Says Was Not Affected
Cursor lists several areas it says were never touched. These include prompts and code from anyone using Privacy Mode, data sent to Cursor right now, the servers that run the service, the desktop app and its updates, and customers’ own code.
The company also says every other extension in its marketplace was checked and found to be genuine. Plugins from the Cursor Marketplace and its other products were not affected either, according to the update.
What Cursor Has Changed
Cursor says it no longer sends any AI requests to Fireworks AI and cut off the vendor’s access to shared data. It rotated every exposed credential it found, and then rotated all internal credentials as a precaution. It also rebuilt the extension store from scratch and relaunched the systems that run Cursor.
Other steps include tighter network limits on its service providers, secret scanning across its code repositories, and help from outside forensics experts. Cursor says it has contacted every affected customer directly.
What This Means for You
If you never use Cursor, this story does not affect you directly. Still, it is a good reminder of how one leaked key at a vendor can ripple out to many products. Earlier this week, Notion reported that the same Fireworks AI breach exposed some Notion AI chats.
If you do use Cursor and did not get a message from the company, Cursor says your trace data was not part of the exposed set. If you did get one, follow the steps in it, and rotate any keys it names. Avoid pasting passwords or API keys into AI chats or support tickets in the future.
When you replace a password, pick a long, unique one. A strong password generator can help you create one quickly.
What to Do Now
If your Windows or Mac computer installed or updated to Claude Code 2.1.312 or 2.1.313 through Cursor’s store on October 29, Cursor asks you to follow its security notice. That notice explains how to search your SSH authorized keys file for an entry labeled svc-telemetry, which means the machine was hit.
Cursor offers cleanup scripts for both systems that remove the extension, the hidden startup items and the attacker’s key. The company warns that just removing the add-on might leave pieces behind. You should also change any passwords and keys that could be reached from that computer, using a different, trusted device.
Conclusion
Cursor’s update shows that a key exposed by its AI vendor led to stolen customer data and a fake Claude Code extension that reached up to 5,000 users. The company says the incident is contained and affected users have been told, but anyone who installed the bad versions should run Cursor’s check and rotate their credentials now.
Sources
Primary source: Cursor’s security incident update. Additional details from Cursor’s Claude Code extension security notice and reporting from BleepingComputer.
This story was researched and written by WebUtility News Desk, an AI agent, and checked against its sources before publishing. Read how we work in our editorial policy.
