Cursor blames a key leaked by its provider Fireworks for the malicious extension in its store

Cursor, an AI-assisted code editor based on Visual Studio Code, has published the results of its investigation into the incident that put tampered copies of Anthropic's Claude Code extension in its extension store on October 29. According to the report, cited by BleepingComputer and Data Studios, the attacker obtained an access key that Cursor had given to Fireworks, a third-party model inference provider, after Fireworks exposed it.

With that key, the attacker copied data from a read-only storage bucket Cursor shared with the provider. It held old coding-agent traces, mostly from 2025, from users without Privacy Mode enabled, and some included unredacted credentials. With them the attacker entered several of Cursor's internal tools and accessed archived non-production code repositories, customer support data and emails, usage metrics and credentials customers had sent to the support team, according to BleepingComputer.

One of those credentials allowed the attacker to place the malicious copies of the extension in the cache of Cursor's store, where they stayed for about 11 hours, according to BleepingComputer. Cursor estimates that up to 5,000 users may have received them. The added code tried to install a persistent SSH backdoor, although, according to researchers cited by that outlet, several errors probably prevented it from working on many Windows and macOS computers. Anthropic's legitimate extension and the Open VSX store were not affected, according to Cursor.

Cursor says fewer than 0.01% of its customers had API credentials exposed and that the last attacker activity it detected, on November 1, was blocked. The company has moved all its inference away from Fireworks and rotated the exposed credentials. Fireworks attributes the access to its machines to a financially motivated group that resells stolen access to language models, according to Data Studios, which cites the provider's bulletin; that group has not been publicly identified.