Cursor Traces Its Security Breach to a Fireworks Key — Fake Claude Code Extension Reached Up to 5,000 Users
Cursor has closed the loop on the security incident that rattled its users in October, and the trail doesn’t start in Cursor’s own code. In an update published on November 13, the company says the breach began with an access key it had issued to Fireworks AI, one of its inference vendors — a key that was exposed on the vendor’s side.
It’s a short chain with an uncomfortable lesson. One leaked key, a shared storage bucket, and a pile of old session traces were enough to carry an attacker from a partner’s systems all the way into Cursor’s extension marketplace.
It started with a vendor key
According to Cursor’s investigation, the attacker got hold of an access key the company had issued to Fireworks AI. The key was exposed at Fireworks, and the attacker used it to reach a storage bucket the two companies shared.
That bucket was read-only, and it held coding-agent traces — records of past agent sessions. Most of the traces dated from 2025, and they came from sessions that weren’t running in Privacy Mode. On its own, that might have been the end of it. It wasn’t.
Vendor keys are easy to forget about. They get issued during an integration, they keep working quietly in the background, and they rarely sit at the top of anyone’s review list. But a key like this one is standing access — it doesn’t expire just because nobody’s thinking about it, and it only takes one exposure on either side of the partnership for it to end up in the wrong hands.
The traces became the way in
Some of those traces contained credentials that hadn’t been redacted. The attacker found them, and those credentials opened the next door: access to Cursor’s internal SaaS tools.
That’s the part that should make any team pause. Session traces are usually treated as training data or debugging material, not as a security risk. Who expects yesterday’s agent logs to hold live keys? In this case, they did — and a read-only bucket turned into a launchpad.
A fake Claude Code extension reached the marketplace
On October 29, the attacker used that access to place modified copies of Anthropic’s Claude Code extension into the cache serving Cursor’s extension marketplace. The tampered versions were Anthropic.claude-code 2.1.312 and 2.1.313, and they sat in the cache for roughly 11 hours.
Cursor says up to 5,000 users may have received the modified extension during that window. The copies weren’t published by Anthropic — they were planted through the compromised access, which is what makes the incident sting. Developers who installed or updated the extension that day had no obvious reason to suspect anything was off.
How Cursor responded
Cursor says the incident is contained. The last attacker activity it observed was on November 1, and it was blocked. Since then, the company has:
- Revoked the access key issued to Fireworks
- Moved all inference traffic off Fireworks
- Cut off the vendor’s access to the shared data
- Rebuilt the extension marketplace
Cursor also says it contacted affected customers directly with the details that applied to them. It’s a fuller account than the brief notice users got when the incident first surfaced in October, and it names the vendor where the chain began rather than keeping the details vague.
What developers should take from this
If you installed or updated the Claude Code extension inside Cursor around October 29, check which version you received — 2.1.312 and 2.1.313 are the ones Cursor flagged. Beyond that, the incident is a reminder that agent tooling carries a wider trust chain than a normal app. The traces your coding agent leaves behind can hold real credentials, and the vendors behind the model calls are part of your security surface whether you planned for it or not.
There’s a smaller, practical point buried in the details too. The traces the attacker copied came from sessions that weren’t in Privacy Mode. That’s not a criticism of the users involved — most people never touch the setting. But if your team works in Cursor with anything sensitive nearby, this incident is a decent argument for switching Privacy Mode on and for treating old session data as something that needs the same care as a credentials file.
It’s also a useful contrast with where the tooling is heading. Cursor has been busy on the product side too — we recently covered how Cursor now lets developers build live apps from a prompt — while other tools, like the AWS emulator that lets coding agents test cloud operations locally, are built around keeping agent work contained before it touches live systems. After an incident like this one, that containment idea looks less like a nice extra and more like the point.