On November 13, Cursor published the findings of its investigation into the October 29 security incident on its official blog: the attack began with an access key leaked by third-party vendor Fireworks. The attacker used it to copy coding agent traces from a read-only storage bucket and slipped a tampered copy of the Claude Code extension into the cache serving Cursor's extension marketplace. At most 5,000 users may have installed the tainted version. The vast majority of users were unaffected, and Cursor has contacted each affected user individually.
How the attack unfolded
The investigation reconstructs the sequence roughly as follows. It started at Fireworks: the attacker obtained a key Cursor had issued to the vendor and copied coding agent traces, mostly from 2025, from a read-only storage bucket. A small number of unredacted records contained credentials, exposing the API credentials of fewer than 0.01% of users. With those credentials, the attacker reached some of the SaaS tools Cursor uses and accessed archived non-production source code repositories, customer support data and email conversations, product usage metrics, and credentials users had sent to the support team. After its monitoring systems spotted the unauthorized activity, Cursor deactivated the vendor's key and began rotating credentials and hunting for further unauthorized access.
The second stage was the malicious extension. On October 29, the attacker used a stolen credential to place tampered copies of the Claude Code extension, versions 2.1.312 and 2.1.313, in the cache serving Cursor's extension marketplace, where they stayed for about 11 hours before being taken down. Anthropic did not publish this copy, and Open VSX, the source of the marketplace, was never infected. At most 5,000 users who requested specific cached versions may have received it. On October 30, Cursor published a security notice and checking scripts and began notifying affected users and team admins; the last attacker activity was seen on November 1 and was blocked. Cursor believes the incident is contained.
Who needs to check their setup
Users who received no notification had no data in the exposed traces and need to do nothing — fewer than 0.05% of non-Privacy Mode users had coding agent traces exposed. But anyone who installed or updated the Claude Code extension to versions 2.1.312 or 2.1.313 from Cursor's extension marketplace on October 29 should follow the steps in the official security notice; uninstalling the extension alone is not enough. Prompts and code from Privacy Mode users, production systems, the Cursor app and its official updates, and customer code repositories were all unaffected. Cursor has had a rough stretch lately: OpenAI models left Cursor on November 12.
Cursor has moved all inference traffic off Fireworks and deactivated the relevant key, rotated all internal credentials, rebuilt the extension marketplace, and brought in external forensics experts. The episode is a reminder to every developer that an extension marketplace's cache layer can itself become an attack surface — check that the publisher is the official one before installing an extension.
