Cursor Says Stolen Fireworks AI Key Led to Trojanized Claude Code Extension Incident

The compromise of Anthropic's official Claude Code extension on Cursor's marketplace resulted from a stolen access key exposed during a breach targeting Fireworks AI. Cursor confirmed that an attacker obtained an access key issued to Fireworks, which was then used to copy data from a read-only storage bucket used for sharing information between the companies.

The disclosure comes nearly two weeks after a trojanized version of Anthropic's Claude Code extension was distributed through Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.

Exposed Data Details

The read-only storage bucket contained limited coding agent traces from sessions not in Privacy Mode, which were permitted for model training. Among these traces were credentials that had not been edited out, exposing API credentials of less than 0.01% of customers.

The attacker used these credentials as a starting point to reach select software-as-a-service (SaaS) tools used by Cursor and then access the following data - select archived non-production Cursor source code repositories, including some containing business contact information, limited customer support data and email conversations, product usage metrics and contact details, summaries of some coding agent conversations, and some credentials users had sent to the Cursor support team.

Attack Timeline

Cursor took immediate steps to deactivate the vendor's key, revoke and rotate credentials, and contain the breach after identifying further access. The company temporarily disabled internal and product services, disrupting access to some Cursor features.

The next phase occurred on October 29, 2026, when the attacker used stolen credentials to place trojanized versions of Anthropic's Claude Code extension directly on Cursor's extension marketplace cache.

At most 5,000 users who requested specific cached versions of the extension on October 29 potentially received the malicious build, which was available for approximately 11 hours before being removed.

Broader Impact

Cursor emphasized that no additional malicious activity has been detected since November 1, 2026. There is no evidence the incident impacted users who had enabled Privacy Mode, customer code repositories, Cursor's production environment, or other apps and extensions.

The development follows similar breaches at other companies. Uber confirmed that unknown threat actors stole thousands of drivers' license information after obtaining internal credentials through the same Fireworks AI incident. Online productivity startup Notion also confirmed its data was stolen in the Fireworks AI hack.