Cursor on its security incident: a leaked vendor key led to a fake Claude Code extension

How did a fake Claude Code extension end up in Cursor's marketplace? According to the account Cursor published on November 13, 2026, it started with an access key that Cursor had issued to its vendor Fireworks and that Fireworks had exposed. An attacker used it to copy stored session data from coding agents. Credentials found in that data opened other systems, and finally the marketplace cache, where a malicious copy of the extension was available for about 11 hours on October 29.

We read the account on Cursor's blog. The topic also appeared in the trending briefing of November 14.

What happened

Cursor disclosed the incident on October 29 and published a security notice on October 30 with indicators of compromise and check scripts. The new account follows about two weeks of investigation. The attacker used the key to copy a storage bucket that Cursor shared with Fireworks. It held coding agent traces, mostly from 2025, from sessions that were not in Privacy Mode. Cursor was allowed to use those for model training.

Some traces contained unredacted credentials. Cursor says fewer than 0.01 percent of customers had API credentials in that data. With them the attacker got into several SaaS tools used by Cursor. There he reached archived non-production source code, limited support data and email, usage metrics and contact details, summaries of agent conversations, and credentials that users had sent to support.

The fake extension

Using a stolen credential, the attacker placed malicious copies of Anthropic.claude-code, versions 2.1.312 and 2.1.313, on the cache that serves Cursor's VS Code marketplace. Cursor writes that Anthropic did not publish those copies and that this is not a vulnerability in Anthropic's product. Open VSX, the marketplace source, never had the malware. At most 5,000 users who requested those specific versions on October 29 may have received the malicious build.

According to Cursor, live traffic, production systems, the Cursor app and official updates were not affected: they ship from a separate code system, and no release signing keys were exposed. Other extensions, plugins from the Cursor Marketplace and customer repositories were not affected either, the company says. Prompts and code from users with Privacy Mode are out of scope.

What Cursor did

Cursor moved all inference traffic off Fireworks and deactivated the key. It rotated every exposed credential it found and, as a precaution, every credential in internal use. It rebuilt the marketplace, added secret scanning to repositories and other internal sources, and redeployed all production infrastructure. External forensics experts were brought in and affected customers were contacted directly.

What this means

If you installed version 2.1.312 or 2.1.313 through Cursor's marketplace during the exposure window, follow the steps in the October 29 notice; Cursor warns that uninstalling the extension alone may not be enough. If you received an email, rotate the credentials it lists. More broadly, the case shows that agent traces are sensitive data: whatever an agent sees can end up in such a trace. We wrote earlier about secrets in Claude Code settings. Another case of customer data leaking at an AI service is covered in our piece on the Workers AI KV cache, and the wider context is in our overview of AI and cybersecurity.

What we did not check

We did not go through the October 29 notice or the check scripts ourselves. We found no response from Fireworks on how the key was exposed. The figures on affected users come from Cursor alone.

Checked on November 14, 2026.

This article was written with AI (Claude) and checked against the sources below.

Sources

• Cursor, An update on our recent security incident (November 13, 2026): cursor.com
• @cursor_ai on X (signal): x.com