Cursor Just Revealed How a Leaked Vendor Key Led to a Tampered Claude Code Extension

 

Cursor has finally explained how its October security incident really happened — and the trail leads outside Cursor itself. In an update published on November 13, 2026, the AI coding company said the breach began at Fireworks AI, one of its inference vendors, after an access key it had issued to Fireworks was exposed there. What followed was a chain reaction: stolen coding agent traces, harvested credentials, and a tampered extension slipped into the cache that serves Cursor's marketplace. Here is what happened, what was affected, and what you should do now.

How the breach unfolded

According to Cursor, the attacker used the exposed Fireworks key to copy coding agent traces from a read-only storage bucket Cursor used to share data with Fireworks. Most of the traces dated from 2025 and came from sessions outside Privacy Mode. A small number of those traces contained unredacted credentials. Cursor says fewer than 0.05% of users had traces exposed, and fewer than 0.01% of customers had API credentials exposed — and that it notified each affected user directly. Using those credentials, the attacker reached some of the SaaS tools Cursor uses internally. That foothold set up the second, more alarming stage of the attack.

The tampered extension

On October 29, the attacker placed modified copies of Anthropic's Claude Code extension — versions 2.1.312 and 2.1.313 — directly into the cache serving Cursor's VS Code extension marketplace. Up to 5,000 users who requested those cached versions may have received the malicious build during an approximately 11-hour window, from 2:27 a.m. to 1:35 p.m. Pacific on October 29. Cursor says the last attacker activity was on November 1 and it was blocked. The company has since moved all inference off Fireworks, revoked the exposed key, rotated internal credentials, and expanded its secret scanning.

What was and wasn't affected

There is good news in the update, too. Cursor says its production infrastructure, official updates, release signing keys, and customer code repositories were NOT affected. The malicious builds also never appeared on upstream Open VSX — they existed only in Cursor's marketplace cache. One attribution note matters: that the key was 'exposed by Fireworks' is Cursor's account of events. Fireworks' own security bulletin of November 9 does not mention Cursor.

What users should do now

Check whether you received Claude Code 2.1.312 or 2.1.313 through Cursor's marketplace cache around October 29, and update to a clean version if you did. Rotate any credentials that may have appeared in your agent traces. And if you do not want your traces used for training, turn on Privacy Mode.

Our take

The incident is a reminder that a coding assistant's security is only as strong as its vendors' — and that a single leaked key can travel a long way. Cursor's disclosure is detailed and unusually candid, and that transparency is exactly what users need to judge their own exposure. OpenAI, meanwhile, has been hiring AI hackers to protect its own systems — a sign the whole industry is treating this as a shared problem.