Cursor confirms security breach led to malicious Claude Code extension

Cursor published an incident report detailing a security breach after unauthorized actors gained access to credentials via third-party AI provider Fireworks AI, according to BleepingComputer's report. The intrusion enabled the attackers to place malicious, unauthorized versions of Anthropic's Claude Code extension directly on the cache serving the Cursor Visual Studio Code extension marketplace.

This article details the initial supply chain compromise, the scope of exposed user traces and credentials, the mechanics of the trojanized marketplace extension, and the remediation steps required for affected engineering teams. The breakdown covers developers, software teams running Cursor on macOS or Windows, and administrators managing third-party AI inference keys.

01Stolen Fireworks access key and trace leaks

The compromise originated when hackers retrieved an access key stored on Fireworks AI, an external vendor Cursor used for AI model training and inference. The attackers used that credential to extract data from a read-only storage bucket that Cursor used to exchange data with Fireworks. The bucket contained historical AI coding-agent traces, mostly from 2025, gathered from users who had not activated Privacy Mode.

Some of those stored traces contained unredacted API credentials belonging to users, which the attackers used to pivot across Cursor's internal services. Cursor stated that fewer than 0.05% of its users had coding-agent traces exposed during the incident, and fewer than 0.01% of customers had API credentials compromised. Users who had enabled Privacy Mode were not affected by the trace exposure.

With the harvested credentials, the attackers accessed several internal software-as-a-service systems across Cursor's environment. The compromised data included archived non-production source code repositories, limited customer support conversations, usage metrics, contact information, agent conversation summaries, and credentials previously shared with support personnel. Cursor revoked the Fireworks key and rotated internal secrets upon detecting the intrusion.

02Marketplace cache poisoning and backdoor payload

Before Cursor contained the pivot, the attackers extracted a credential that permitted modification of marketplace distribution caches. On October 29, the attackers published unauthorized versions of Anthropic's Claude Code extension, specifically tagged as versions 2.1.312 and 2.1.313. Neither Anthropic's official extension release nor the upstream Open VSX marketplace was breached during the event.

The attackers modified legitimate extension code to execute malicious JavaScript designed to deploy persistent SSH backdoors on developer workstations. The script collected local system metadata, inserted an attacker-controlled SSH key into local authorized key lists, and attempted to turn on SSH services. Coding flaws in the malicious payload prevented the backdoor from functioning on many Windows and macOS environments lacking pre-enabled SSH servers.

The tainted extension packages remained live in the Cursor marketplace cache for approximately 11 hours before security personnel identified and purged them. Cursor calculated that up to 5,000 developers downloaded or updated to the affected builds while the poisoned packages were active. Official IDE releases, production codebases, and core application binaries remained uncompromised.

03Infrastructure isolation and traffic migration

Cursor initiated an immediate containment process across all model serving infrastructure to stop unauthorized access paths. Engineering teams migrated all inference traffic completely away from Fireworks AI following the disclosure. The incident response team rotated all exposed credentials, rebuilt the extension marketplace architecture, and redeployed production application instances from clean images.

The breach forms part of a broader wave of attacks dubbed Black October by cybersecurity firm Wiz, which targeted AI developer tooling. Attackers across the campaign sought authentication secrets to run unauthorized inference workloads and conduct model distillation. Other organizations targeted in the cluster included Railway, Northflank, Lightning AI, OpenCode, and Warp.

The financial and operational impact across affected development tools proved substantial during the wider campaign. Railway reported customer credential theft that generated approximately $740,000 in fraudulent AI inference charges, while Notion noted exposed AI chat transcripts tied to the Fireworks compromises. Cursor contained its breach before attackers could use stolen developer credentials for large-scale external API consumption.

04Remediation steps and environment updates

Developers who installed or updated the Claude Code extension inside Cursor on October 29 must verify their workstations and remove unauthorized SSH credentials. Cursor advised impacted engineers to audit their SSH authorized_keys files, terminate active remote sessions, and rotate any development secrets stored on local machines during the exposure window.

To ensure your local CLI environment runs the official release directly from Anthropic, update or reinstall the Claude Code package through the global package manager:

npm install -g @anthropic-ai/claude-code

Verify your active runtime configuration and switch to the desired model profile directly within the interactive session interface:

/model claude-3-5-sonnet-20241022

To initialize the command-line assistant pinned to a specific model version from the terminal, launch the binary using the model parameter:

claude --model claude-3-5-sonnet-20241022

Configure your persistent default model profile using the configuration command:

claude config set model claude-3-5-sonnet-20241022

05Security controls and cloud provider exposure

Engineering teams using third-party AI platforms must evaluate data retention policies regarding trace logs and training bucket storage. Cursor confirmed that traces collected in 2025 without Privacy Mode provided the pivot point for the attackers. Enabling strict privacy options isolates prompts and agent outputs from external vendor training pools and shared storage buckets.

Third-party providers remain an active vector for credentials and inference abuse. Fireworks AI confirmed multiple breaches in October involving exposed tokens and access to developer machines via a third-party cloud provider. Development organizations must monitor external AI infrastructure keys for anomalous queries or unauthorized training storage pulls.

Cursor continues monitoring systems while working with affected customers who received the poisoned extension builds. Developers who operated outside the 11-hour window on October 29 or who had Privacy Mode active require no extension rollbacks, though checking local authorized keys remains a baseline precaution for all developers using shared marketplace caches.