Cursor Blames Stolen Fireworks AI Key for Trojanized Claude Code Attack

The latest:

An access key Cursor had issued to Fireworks AI was stolen after being exposed in a breach of the inference provider, and the attacker used it to pull data from a read-only storage bucket, the company said in a Friday update. That data became the starting point for an intrusion that ended with a trojanized Claude Code extension on Cursor’s marketplace.

Details:

• The entry point: Cursor said the attacker obtained an access key the company had issued to Fireworks, that the key was exposed by Fireworks, and that it was used to copy data from a read-only storage bucket the two companies shared. Cursor has since deactivated the key and moved all inference traffic off Fireworks.
• What the bucket held: According to Cursor, the bucket contained limited coding agent traces from sessions not in Privacy Mode, most dating to 2025 and cleared for model training. Some traces still carried credentials that had not been stripped out, exposing API credentials belonging to fewer than 0.01% of customers.
• How it spread: Cursor said the attacker used those credentials to reach select software-as-a-service tools it relies on, then accessed archived non-production source code repositories, some containing business contact information, along with limited customer support data and email conversations.
• Further data touched: Cursor listed product usage metrics and contact details, summaries of some coding agent conversations, and credentials users had sent directly to its support team among the data reached. The company has not quantified how many records fell into each category.
• The backdoor: The next phase came on October 29, 2026, when the attacker used a stolen credential to place trojanized builds of Anthropic’s official Claude Code extension on the cache serving Cursor’s marketplace. The malicious package attempted to install a persistent SSH backdoor on affected machines.
• The blast radius: Cursor said at most 5,000 users who requested specific cached versions on October 29 potentially received the malicious build, which was live for roughly 11 hours. The company pulled it down, took the marketplace offline, and worked with the cloud provider hosting the attacker’s server to shut it down.
• The response: Cursor said it revoked and rotated credentials, hunted for signs of deeper access, and temporarily disabled internal and product services, disrupting some features. It notified users who installed versions 2.1.312 or 2.1.313 during the exposure window and helped revoke exposed credentials.
• What was untouched: Cursor said there is no evidence the incident reached Privacy Mode users, customer code repositories, its production environment, the Cursor app and its official updates, its other apps, or any other marketplace extension. It reported no additional malicious activity since November 1, 2026.
• The wider fallout: Uber told California regulators that a service provider was notified on October 9, 2026 of a credential compromise, and that by October 13 investigators confirmed Uber data had been accessed. Uber did not name the provider; TechCrunch reported it is Fireworks AI. Notion also confirmed stolen data.

Background:

Privacy Mode is a Cursor setting that lets users opt out of having their data used for model training. Sessions run outside it were eligible for training use, which is why their traces sat in the shared storage bucket at the center of the breach.

Between the lines:

The chain runs through a vendor, not through Cursor’s own production systems: one exposed key at an inference provider surfaced unredacted credentials inside stored agent traces, and those credentials carried the attacker into SaaS tools and eventually the marketplace cache. Uber’s and Notion’s disclosures suggest the same provider compromise fanned out across multiple customers.

What’s next

Watch for Uber to disclose how many drivers were affected, for Fireworks AI to publish its own account of the breach, and for any further customers of the provider to come forward with disclosures.