Cursor confirms breach via Fireworks AI key led to malicious Claude Code extension
Cursor's incident report traces the attack from a key held by a third-party AI provider to backdoored extensions that sat on its marketplace for about 11 hours.
By Mr Elite Published 7 min read
- Severity
- High
- Status
- Confirmed by the organisation
- Sources
- 1
- Last checked
The short version
- Cursor said attackers obtained an access key stored at Fireworks AI, then used credentials found in stored coding-agent traces to reach more systems.
- Malicious Claude Code extension versions 2.1.312 and 2.1.313 were available for approximately 11 hours before Cursor removed them.
- Cursor estimates up to 5,000 users may have received the malicious builds.
- Researchers found coding errors that likely stopped the backdoor working on many Windows and macOS machines.
- BleepingComputer reported that the incident comes amid a wave of attacks on AI developer platforms that Wiz has dubbed "Black October". The sources do not say whether Wiz or Cursor has directly linked the two.
What happened
Cursor, the AI code editor, confirmed in an incident report published on Friday that attackers used an access key stored at the AI provider Fireworks AI to reach its systems and push malicious Claude Code extensions to its marketplace on 29 October, BleepingComputer reported.
Cursor said the attack began when hackers obtained an access key stored at Fireworks AI, a third-party provider used for AI model training and inference. The attackers used that key to copy data from a read-only storage bucket that Cursor used to share information with Fireworks.
The bucket held historical coding-agent traces, mostly from 2025. These came from users who had not enabled Privacy Mode and whose data could be used for model training. Cursor said some traces contained unredacted API credentials, which gave the attackers a way into further Cursor systems.
With those credentials, the attackers stole data from several of Cursor's software-as-a-service tools, according to the report. That data included archived non-production source code repositories, some with business contact information, limited customer support emails, product usage metrics, customer contact details, and credentials customers had earlier shared with support.
Cursor said its monitoring detected the activity. It revoked the Fireworks key, rotated exposed credentials and temporarily switched off some internal and product services. BleepingComputer reported that the attackers had already obtained a credential that let them distribute extensions through the marketplace. The source does not make clear exactly when they got it relative to detection.
The company said that on 29 October the attacker placed malicious copies of Anthropic's Claude Code extension in the cache that serves its VS Code extension marketplace. Versions 2.1.312 and 2.1.313 stayed up for approximately 11 hours before removal. Cursor said Anthropic's legitimate extension and Open VSX, the marketplace Cursor draws on, were not compromised.
Why it happened
Cursor's account describes a chain. An access key at a third-party provider opened a storage bucket. The bucket held agent traces that contained live credentials. Those credentials opened SaaS tools, and one of the stolen credentials allowed publishing to the extension marketplace cache.
BleepingComputer reported that the attackers modified the real Claude Code extension so it ran malicious JavaScript. The code collected system information, installed an attacker-controlled SSH key, tried to enable SSH access and set up persistence. SSH is a remote login service, so the key would have given the attacker a standing way in.
The source describes the Fireworks key as exposed but does not say how it was exposed or first obtained.
How this kind of failure works
Several ordinary weaknesses stack up in incidents like this. Secrets end up in places they should not be, long-lived keys are never retired, and one credential is allowed to do too much. When an attacker finds one, each new system they open tends to hold the next one.
Coding agents make the first problem easy to miss. An agent that runs commands or reads config files can capture an API key in its own log of what it did. If those logs are kept for later use, such as model training, the key travels with them into storage nobody thinks of as sensitive.
Picture a builder who photographs a job site for records, and one photo shows the master key hanging on a hook. The photos go to a contractor's shared folder. Anyone who gets into that folder now has the key, even though nobody meant to store it there.
A marketplace cache adds a further risk. Developers trust an extension that appears under a familiar name, and editors often update extensions automatically. A credential that can publish to the marketplace therefore reaches many machines quickly, with little for the victim to check.
Who is affected
Cursor said up to 5,000 users who requested the affected extension versions during the exposure window may have received the malicious builds. Anyone who installed or updated the Claude Code extension in Cursor during the attack should check whether they had version 2.1.312 or 2.1.313, and follow Cursor's remediation guidance.
On the data theft, Cursor said fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% of customers had API credentials compromised. Those affected were users without Privacy Mode. Cursor said production infrastructure, official application releases, customer code repositories, and code and prompts of Privacy Mode users were not affected.
Researchers found coding errors that likely stopped the backdoor working on many Windows and macOS systems where SSH was not already enabled, BleepingComputer reported. That lowers the likely impact but does not rule out compromise, so machines that ran the extension deserve a check.
How to defend against it
Tick each step as you check it. Your progress is saved on this device.
What to learn from this
The concept: Secrets sprawl and credential blast radius
Secrets sprawl means credentials spread into logs, chat histories, support tickets and backups, where nobody tracks them. Blast radius is how much damage one stolen credential can do. The Cursor incident shows both: keys in traces led to many systems, and one of them could publish software.
The same pattern appears in leaked keys in public code repositories, passwords pasted into help-desk emails and cloud tokens stored in build logs. The defence is also the same. Keep secrets out of text that gets copied around, give each one narrow rights, and make it expire.
Assume any credential an agent or tool can see may end up in a log, and limit what that credential can do.
Quick check
Why did credentials in old coding-agent traces matter so much in this incident?
The traces held live API credentials, so a single bucket copy opened further Cursor systems. Cursor said Anthropic's legitimate extension was not compromised.
Timeline
- 2025 (mostly) Date of most of the coding-agent traces later exposed from the shared storage bucket, per Cursor.
- Date not given Attackers obtained an access key stored at Fireworks AI and copied data from the storage bucket. The source gives no dates for these steps.
- 29 October Attacker used a stolen credential to place malicious Claude Code extension copies, versions 2.1.312 and 2.1.313, in the marketplace cache.
- After publication on 29 October Cursor removed the malicious extension versions after they had been available for approximately 11 hours. The source does not give the removal date.
- Friday before 14 November Cursor published its incident report, according to BleepingComputer. The source says only "Friday".
What is not known yet
- How the Fireworks AI access key was first obtained.
- How many of the up to 5,000 users who may have received the builds were actually compromised.
- Who is behind the attack; the source names no culprit.
- Whether the incident is directly linked to the Black October campaign, beyond BleepingComputer reporting that it comes amid those attacks.
- The exact dates of the key theft, the bucket copy and the removal of the extensions.
- Whether the attackers held the marketplace publishing credential before Cursor detected the activity.
Questions people ask
What did the malicious Cursor Claude Code extension do?
BleepingComputer reported that it ran malicious JavaScript that collected system information, installed an attacker-controlled SSH key, tried to enable SSH access and set up persistence. Researchers found coding errors that likely stopped it working on many Windows and macOS systems where SSH was not already enabled.
Which Claude Code extension versions were malicious?
Cursor named versions 2.1.312 and 2.1.313. They were available for approximately 11 hours before Cursor removed them. Cursor said Anthropic's legitimate extension and Open VSX were not compromised.
Was my code exposed in the Cursor breach?
Cursor said customer code repositories and the code and prompts of users with Privacy Mode enabled were not affected. Users without Privacy Mode may have had historical agent traces exposed, which Cursor said applied to fewer than 0.05% of users.
What is Black October?
BleepingComputer reported that Wiz used the name for a wave of attacks on AI developer platforms that targeted development infrastructure to steal credentials, especially those giving access to AI models. BleepingComputer listed Railway, Northflank, Lightning AI, OpenCode and Warp among affected companies. At Railway, stolen secrets were used to generate approximately $740,000 in fraudulent AI charges.
Sources
- BleepingComputer: Cursor confirms security breach led to malicious Claude Code extension