Cursor has confirmed a security breach that originated from compromised credentials at third-party AI infrastructure provider Fireworks AI, enabling attackers to distribute malicious copies of Anthropic's Claude Code extension through its marketplace.
The incident, detailed in a new report published on November 14, 2026, also allowed unauthorized access to internal systems and the theft of customer data. This included historical AI coding-agent traces from 2025 belonging to users who had not enabled Privacy Mode, some of which contained unredacted API credentials later used to compromise additional services.
Cursor, an AI-powered code editor built on Microsoft's VS Code, stated that fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% had API credentials compromised. Using the stolen credentials, attackers accessed several SaaS tools and obtained archived source code repositories, limited customer support information, product usage metrics, and summaries of AI coding-agent conversations.
Malicious Extension Deployment
On October 29, 2026, the attackers used a stolen credential to publish malicious versions 2.1.312 and 2.1.313 of the Claude Code extension on Cursor's marketplace cache. These versions remained available for approximately 11 hours before removal. The modified extensions executed malicious JavaScript designed to install persistent SSH backdoors, collect system information, and configure remote access mechanisms.
Although the attack did not compromise Anthropic's legitimate extension or the Open VSX marketplace, up to 5,000 developers who requested the affected versions may have received the malicious builds. Security researchers noted coding errors that likely limited the backdoor's effectiveness on many Windows and macOS systems.
Cursor responded by revoking the Fireworks access key, rotating exposed credentials, temporarily disabling some services, rebuilding its extension marketplace, and redeploying production infrastructure. The company has also moved all inference traffic away from Fireworks AI.
Context of Broader AI Platform Attacks
The breach occurred amid a series of incidents targeting AI developer platforms, collectively referred to as "Black October." These attacks focused on stealing authentication credentials for unauthorized AI inference and model distillation, affecting companies including Railway, Northflank, Lightning AI, OpenCode, and Warp. At Railway alone, stolen secrets led to approximately $740,000 in fraudulent AI charges.
Fireworks AI itself disclosed multiple breaches in October involving exposed API keys and compromised development machines. Customers who installed the affected Claude Code extension versions are advised to follow Cursor's remediation guidance.
