Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.
The breach also let attackers access internal systems and steal customer data, including historical AI coding-agent traces containing unredacted credentials that were later used to compromise additional services.
The breach was disclosed in a new incident report published Friday, which explains how attackers distributed malicious versions of Anthropic's Claude Code extension through Cursor's marketplace on October 29.
The attack exposed up to 5,000 developers to malware that installed persistent SSH backdoors.
Cursor is an AI-powered code editor built on Microsoft's open-source Visual Studio Code (VS Code), allowing developers to write, modify, and debug software using AI assistants.
According to Cursor, the attack began when hackers obtained an access key stored on Fireworks AI, a third-party provider used for AI model training and inference.
The attackers used the exposed key to copy data from a read-only storage bucket Cursor used to share information with Fireworks.
This bucket contained historical AI coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode and whose data could be used for model training. Some of these traces contained unredacted API credentials, allowing the attackers to access additional Cursor systems.
Cursor says fewer than 0.05% of users had coding-agent traces exposed, while fewer than 0.01% of customers had API credentials compromised.
Using the exposed credentials, the hackers stole data from several of Cursor's software-as-a-service (SaaS) tools, including:
- Archived, non-production Cursor source code repositories, some containing business contact information.
- Limited customer support information and email conversations.
- Product usage metrics and customer contact details.
- Summaries of some AI coding-agent conversations.
- Credentials that customers had previously shared with Cursor's support team.
Cursor says its monitoring systems detected the unauthorized activity, leading the company to revoke the Fireworks access key, rotate exposed credentials, and investigate additional unauthorized access.
As the investigation progressed, Cursor temporarily turned off some internal and product services as a precaution.
However, the attackers had already obtained a credential that allowed them to distribute extensions through Cursor's marketplace.
On October 29, the hackers used that credential to publish malicious copies of Anthropic's Claude Code extension on Cursor's VS Code extension marketplace.
"On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace," Cursor explained.
The attack did not compromise Anthropic's legitimate extension or Open VSX, the extension marketplace Cursor uses.
The malicious extensions, versions 2.1.312 and 2.1.313, were available for approximately 11 hours before Cursor removed them.
As BleepingComputer previously reported, the attackers modified the legitimate Claude Code extension to execute malicious JavaScript that attempted to install persistent SSH backdoors on developers' computers.
The malware collected system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and configured persistence mechanisms to maintain remote access.
However, security researchers found coding errors that likely prevented the backdoor from working on many Windows and macOS systems where SSH was not already enabled.
Cursor estimates that up to 5,000 users who requested affected extension versions during the exposure window may have received the malicious builds.
The company says its production infrastructure, official application releases, customer code repositories, and code and prompts belonging to users with Privacy Mode enabled were not affected.
Cursor says it has moved all inference traffic away from Fireworks, revoked and rotated exposed credentials, rebuilt its extension marketplace, and redeployed its production infrastructure as a precaution.
Customers who installed or updated to the affected Claude Code extension during the attack are advised to follow Cursor's remediation guidance.
Black October
The incident comes amid a wave of attacks targeting AI developer platforms that cybersecurity company Wiz has dubbed "Black October".
These attacks targeted development infrastructure to steal authentication credentials, especially those providing access to AI models.
Stolen credentials have been used for unauthorized AI inference, generating substantial charges for affected customers, with some incidents also linked to attempts at AI model distillation.
The attacks have affected numerous companies, including Railway, Northflank, Lightning AI, OpenCode, and Warp.
At Railway, attackers stole customer authentication secrets, which were later used to generate approximately $740,000 in fraudulent AI charges. OpenCode also reported exposed API keys and unauthorized AI usage.
Fireworks AI was also affected, disclosing multiple security breaches in October, including one involving exposed API keys and tokens and another in which attackers accessed development machines through a compromised third-party cloud provider.
The Fireworks incidents also affected other customers, including Notion, which recently disclosed that AI chat transcripts from a small number of workspaces were exposed.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.