Cursor said an access key exposed at the vendor Fireworks AI let an attacker obtain coding-session data and credentials, access selected Cursor systems, and place a malicious Claude Code extension in Cursor’s marketplace cache.
In an update published November 13, Cursor said the key provided access to a storage area that could only be read. The area contained limited records of coding-agent activity, mostly from 2025 and from sessions that were not in Privacy Mode. Some records contained access credentials that had not been removed.
Cursor said API access details for fewer than 0.01% of its customers were exposed. The attacker used the credentials to reach selected software services. Cursor said the attacker accessed archived repositories not used in production, limited support records and emails, usage metrics, contact details, conversation summaries, and some access details customers had sent to support.
On October 29, the attacker used a credential taken from Cursor’s internal systems to place unauthorized copies of Claude Code extension versions 2.1.312 and 2.1.313 in the marketplace cache. Cursor said these versions were available for about 11 hours. Up to 5,000 users who requested the versions may have received the malicious builds.
This did not mean that all those users installed them or were compromised. The extension tried to collect device information and set up remote access that would remain in place. Cursor noted that errors in the malicious code could stop some steps to create a hidden way to access systems remotely from working.
Cursor said Anthropic did not publish the copies. Cursor said Anthropic’s product was not vulnerable. Cursor said the upstream Open VSX marketplace did not contain the malware.
Cursor said it revoked the vendor key. The company rotated credentials. It contacted affected customers.