Cursor says the malicious Claude Code extension that appeared in its marketplace on October 29 started with an access key it had issued to Fireworks AI — a key Cursor says was exposed by Fireworks, then used to copy coding-agent traces and reach internal tools. Why it matters: if you installed that extension in Cursor that day, uninstalling it alone may not be enough, according to Cursor’s own notice.
November 15, 2026
What happened, according to Cursor
In an update published November 13, Cursor said an attacker used the exposed key to copy data from a read-only storage bucket the two companies used for sharing. That bucket held limited coding-agent traces, mostly from 2025, from sessions that were not in Privacy Mode. A small number of traces contained credentials that had not been redacted. Cursor puts the exposure at fewer than 0.05% of users for traces, and less than 0.01% of customers for API credentials.
From there, Cursor says, the attacker reached select internal software tools and accessed archived non-production source repositories, limited support data and email conversations, product usage metrics and contact details, summaries of some agent conversations, and some credentials users had sent to support.
The extension attack on October 29
Cursor says that on October 29 the attacker used a stolen credential to place malicious, unauthorized copies of Anthropic’s Claude Code extension — versions 2.1.312 and 2.1.313 — directly into the cache that serves its VS Code extension marketplace. At most 5,000 users who requested those cached versions that day potentially received the malicious build, which was available for about 11 hours before removal.
Cursor stresses three points: Anthropic did not publish the copy, this was not a vulnerability in Anthropic’s product, and the upstream Open VSX marketplace never carried the malware. The Hacker News, reporting the update on November 15, described the build as attempting to install a persistent SSH backdoor — a detail that makes the remediation steps in Cursor’s October 30 security notice worth following exactly if you were in the window.
What was not affected, and what Cursor says it has done
Cursor says Privacy Mode prompts and code, live traffic, production systems, the Cursor app and its official updates, release signing keys, customer code repositories, and every other marketplace extension were not affected. It says the last attacker activity it saw was on November 1 and was blocked, and that it believes the incident is contained.
Its response list includes moving all inference traffic off Fireworks, deactivating the key and cutting off shared datasets, rotating exposed and — as a precaution — all internal credentials, rebuilding the extension marketplace, expanding secret scanning and network restrictions, redeploying production infrastructure, and engaging outside forensic experts. Cursor says it has contacted each affected customer directly.
Why it matters
For anyone building with AI coding agents, the lesson is uncomfortable and practical: the traces an agent leaves behind can contain secrets, and a vendor key can turn those traces into a supply-chain attack on a marketplace. Check whether you installed versions 2.1.312 or 2.1.313 from Cursor’s marketplace on October 29, follow Cursor’s remediation steps rather than just uninstalling, and rotate any credential you ever pasted into a non-Privacy-Mode session or a support ticket. That is the “everything AI, tested” takeaway here — the agent’s memory is part of your attack surface.
Frequently asked questions
Was Anthropic’s Claude Code itself compromised?
No, according to Cursor. Anthropic did not publish the malicious copies, and Cursor says this was not a vulnerability in Anthropic’s product.
How many people were affected?
Cursor says at most 5,000 users potentially received the malicious extension build, traces were exposed for fewer than 0.05% of users, and API credentials for less than 0.01% of customers.
What should I do if I installed the extension on October 29?
Follow the steps in Cursor’s October 30 security notice. Cursor specifically warns that uninstalling the extension alone may not be enough.
Sources: Cursor, The Hacker News