Cursor traces its breach to a leaked Fireworks AI key; up to 5,000 users may have got backdoored builds
An access key Cursor issued to Fireworks AI was exposed, letting an attacker slip unauthorised builds of the Claude Code extension into Cursor's marketplace cache for about 11 hours on October 29.
📊 Scorecard: our Bearish call on $CRWD is scored from $226.61, the last close before it ran. Its first result comes after the next close.
The News
Cursor, the AI coding editor, published an incident update on November 13 tracing its October breach to an access key it had issued to Fireworks AI, an AI infrastructure company, which Fireworks exposed. The attacker used the key to copy historical coding-agent traces and credentials from a read-only storage bucket — a simple online storage container — that Cursor used to share data with Fireworks. From there the attacker reached select software tools Cursor uses.
The sharp end came on October 29. Using a stolen credential, the attacker placed unauthorised builds of the Anthropic.claude-code extension — versions 2.1.312 and 2.1.313 — directly into the cache serving Cursor's VS Code extension marketplace. A cache is a temporary store that serves files quickly; anyone who requested those specific cached versions during the roughly 11 hours they were available may have received a malicious build. Cursor estimates that is at most 5,000 users.
The wider exposure was small but real. Fewer than 0.05% of users had coding-agent traces exposed — mostly from 2025, from sessions that were not in Privacy Mode — and less than 0.01% of customers had API credentials exposed. API credentials are the secret keys software uses to call a service. Each affected user was notified directly. Cursor says Anthropic did not publish the packages, its own product was not vulnerable, and Open VSX — the open extension marketplace — never hosted the malware.
Cursor says it has contained the incident: it moved all inference traffic off Fireworks, deactivated the vendor key, cut off Fireworks' access to shared datasets, rotated credentials, rebuilt the marketplace and expanded secret scanning. The last attacker activity it observed was November 1, and it was blocked. Fireworks' own bulletin describes a separate October 23–24 incident through a third-party cloud provider hosting its research machines, linked to a financially motivated group that steals AI computing power, a practice known as LLMjacking.
One leaked vendor key turned a coding editor's marketplace into a delivery channel.
Why It Matters
This is a supply-chain story, and supply-chain stories are the ones that should worry developers most. Nobody at Cursor was phished and no Cursor server was broken into in the usual sense — a key handed to a vendor leaked, and that key opened a door into the machinery that delivers software to users' editors. A coding editor is a trusted place: it runs code, holds credentials and touches every file in a project. Slipping a backdoored extension into its marketplace cache turns that trust into a delivery channel.
The 5,000-user figure is an estimate of potential exposure, not confirmed infections — Cursor is careful to say that — but the mechanism is the point: one vendor key, one shared bucket, one cache, and suddenly thousands of developers could be running attacker code inside their editors. It lands in a week when developers are already being told to trust AI coding tools with more of their work.
Analyst's Take
Bearish, because the breach pattern is the story, not the count. Cursor did the right things after the fact — cut the vendor off, rotated credentials, rebuilt the marketplace — and the exposure numbers are small: less than 0.05% of users' traces, less than 0.01% of customers' credentials. But the incident shows how thin the line is between a vendor integration and a supply-chain compromise.
CrowdStrike and Palo Alto Networks are the read-through tickers here, not participants: supply-chain breaches are exactly the threat their customers pay them to stop. Watch whether Cursor says how many of the 5,000 actually installed the bad builds, and whether Fireworks names the third party behind its own October incident. Reader poll: still trusting Cursor, or switching editors? Bullish: the fix was fast and the exposure small. Bearish: a vendor key should never reach the marketplace.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is Fireworks AI's role in the Cursor breach?
Cursor issued Fireworks AI an access key, and Fireworks exposed it. The attacker used the key to copy data from a read-only storage bucket Cursor used to share data with Fireworks, then reached Cursor's tools and placed unauthorised extension builds into its marketplace cache.
What is a backdoored extension build?
It is a version of a software extension that has been altered to include hidden malicious code. In this case, unauthorised builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, were placed in the cache serving Cursor's extension marketplace.
Was Anthropic's Claude Code itself compromised?
Cursor says no: Anthropic did not publish the packages, its product was not vulnerable, and Open VSX never hosted the malware. The bad builds were placed in Cursor's own marketplace cache.
What has Cursor done since?
It moved all inference traffic off Fireworks, deactivated the vendor key, cut off Fireworks' access to shared datasets, rotated credentials, rebuilt the marketplace and expanded secret scanning. It says the last attacker activity was November 1 and was blocked.
👁
Source: Unite.AI