Cursor disclosed on November 13, 2026, that a key exposed by AI infrastructure provider Fireworks started a chain of compromises reaching its internal tools and extension distribution system. According to Cursor, the attacker copied historical coding-agent traces, extracted unredacted credentials, and eventually obtained another credential used to distribute malicious Claude Code builds.
The investigation update explains how the incident developed beyond the extension alert Cursor first shared on October 29. At most 5,000 users potentially received a malicious build during an approximately 11-hour window. Anthropic did not publish those builds, and Cursor says neither Anthropic’s product nor the upstream Open VSX marketplace was compromised.
The consequential detail is the connection between those events: access to an old, read-only dataset ultimately enabled an attack on software delivered to developers.
How a Fireworks-Exposed Key Reached Cursor’s Marketplace
Cursor says the attacker obtained an access key it had issued to Fireworks, a provider it used for model training and inference. That key allowed the attacker to copy a read-only storage bucket shared with the vendor.
The bucket contained limited coding-agent traces, mostly from 2025. These came from sessions outside Privacy Mode that Cursor was permitted to use for model training. Some traces contained credentials that had escaped redaction.
Those credentials opened access to selected software-as-a-service tools used by Cursor. From there, the attacker accessed:
- Archived, non-production Cursor source repositories, some containing business contact information.
- Limited customer support data and email conversations.
- Product usage metrics and contact details.
- Summaries of some coding-agent conversations.
- Credentials that users had sent to Cursor support.
A stolen credential from exposed internal-system data then enabled the attacker to place malicious Claude Code packages directly into the cache serving the Cursor VS Code extension marketplace, according to Cursor’s account.
“Read-only” described the attacker’s permissions on the original bucket, not the usefulness of its contents. A credential copied from that bucket could carry entirely different permissions elsewhere. My view is that this is the incident’s clearest security lesson: historical AI traces need controls appropriate for potential secret storage, even when their intended purpose is offline analysis.
The Reported Impact Has Three Separate Bounds
Cursor’s figures describe different populations and should not be combined into a single affected-user count.
| Exposure | Cursor’s reported upper bound or scope |
|---|---|
| Historical coding-agent traces | Fewer than 0.05% of users; sessions outside Privacy Mode |
| API credentials in those traces | Fewer than 0.01% of customers |
| Malicious extension delivery | At most 5,000 users potentially received affected cached builds |
| Extension availability | Approximately 11 hours on October 29 |
These are Cursor’s first-party estimates, without an independent audit in the cited material. Potential delivery also does not mean 5,000 confirmed infections or working backdoors.
Cursor says it directly notified every user whose historical traces were exposed. It also notified customers whose support or business data may have been involved. Where credentials were exposed, it emailed team administrators the specific keys to rotate and asked the services that issued those credentials to revoke them.
What Cursor Says Was Not Affected
Cursor’s update excludes several important systems and data categories:
- Prompts and code from Privacy Mode sessions.
- Current customer traffic and active inference requests.
- Customer code repositories.
- The production systems and infrastructure running Cursor.
- The Cursor application, official updates, client and cloud-service code, and release-signing keys.
- Other extensions in its extension marketplace.
- Plugins downloaded from the separate Cursor Marketplace.
- Other products, including Cloud Agents for customer teams and Grok Bot.
Cursor says its shipped code lives in a separate code-hosting system the attacker never accessed. That separates the archived, non-production repositories accessed through SaaS tools from the code used to release Cursor.
Privacy Mode’s protection here concerns the historical trace exposure. It should not be read as protection against installing a malicious extension on a workstation.
What the Malicious Claude Code Builds Attempted
The affected packages were Anthropic.claude-code versions 2.1.312 and 2.1.313, distributed through the Cursor VS Code extension marketplace for Windows and macOS. Cursor identifies the exposure window as October 29, 2026, from about 2:27 a.m. to 1:35 p.m. Pacific Time.
According to its technical security notice, the modified extension collected host and user information, including operating system details, directory paths, environment-variable names, configured Git email, and public IP address.
It also attempted to:
- Add an attacker-controlled SSH key labeled
svc-telemetry. - Enable the local SSH service and establish a reverse SSH tunnel.
- Maintain persistence through a macOS LaunchAgent or a Windows scheduled task, with a Windows startup-script fallback.
- Retry the tunnel roughly every 60 seconds.
Cursor says coding errors and the requirement for administrator privileges generally prevented the SSH-enabling step when Cursor was running without elevated rights. However, the extension could still add the key, install persistence, and send host details.
That distinction matters for cleanup. A failed attempt to enable SSH does not mean the workstation has no malicious artifacts. Cursor says the attacker’s server was taken offline with help from its hosting provider, but developers should still remediate affected machines.
Developer Response: Check, Isolate, Clean, Rotate
Developers who installed or updated the affected versions during the window should follow Cursor’s security notice. Organizations should also search extension-installation records, endpoint telemetry, and network logs.
Check Installation History and Indicators
Cursor’s notice includes package hashes and platform-specific checks. Useful indicators include:
- The SSH-key label
svc-telemetry. - The defanged attacker IP address
134[.]209[.]82[.]225. - Modified
extension.jsfiles in the affected packages. - Unexpected SSH tunnels and persistence entries.
The key check examines ~/.ssh/authorized_keys on macOS. On Windows, Cursor checks the user’s .ssh\authorized_keys file and C:\ProgramData\ssh\administrators_authorized_keys.
I would use these checks alongside installation and endpoint records. A missing key is narrower evidence than a complete investigation of whether the payload executed.
Isolate Hosts With Evidence of Execution
Cursor advises isolating machines showing payload execution or backdoor installation. Its cleanup guidance covers the unauthorized SSH key, persistence mechanisms, and running tunnel processes, followed by an assessment of whether the host should be rebuilt.
Uninstalling the extension alone is insufficient because standalone persistence scripts can remain running.
Frequently Asked Questions
3 questions
1Was Anthropic’s Official Claude Code Compromised?
Cursor says the malicious copies were placed in its marketplace cache. Anthropic did not publish them, and Open VSX never hosted the malware.
