Cursor Confirms Breach via Fireworks AI That Led to Malicious Claude Code Extension on Its Marketplace

Cursor, the AI-powered code editor, has confirmed a security breach that let attackers access internal systems, steal customer data, and push malicious copies of Anthropic’s Claude Code extension through its extension marketplace. According to Cursor’s incident report, published Friday, the attack started with credentials stolen from Fireworks AI, a third-party AI infrastructure provider. Up to 5,000 developers may have received malware that installs persistent SSH backdoors.

How the attack unfolded

1. Initial access through Fireworks AI: Attackers got an access key stored at Fireworks AI, a provider Cursor used for AI model training and inference.
2. Data theft from a shared bucket: With that key, they copied data from a read-only storage bucket Cursor used to share information with Fireworks. It held historical AI coding-agent traces, mostly from 2025, from users who had not enabled Privacy Mode and whose data could be used for model training.
3. Credentials hidden in traces: Some traces contained unredacted API credentials, which the attackers used to reach more of Cursor’s systems.
4. Breach of SaaS tools: Using those credentials, the attackers stole data from several of Cursor’s software-as-a-service (SaaS) tools.
5. Marketplace compromise: One stolen credential let them distribute extensions. On October 29, they placed malicious, unauthorized copies of the Claude Code extension directly on the cache that serves Cursor’s VS Code extension marketplace.

What data was stolen

• Archived, non-production Cursor source code repositories, some with business contact information
• Limited customer support information and email conversations
• Product usage metrics and customer contact details
• Summaries of some AI coding-agent conversations
• Credentials that customers had previously shared with Cursor’s support team

Cursor says fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% of customers had API credentials compromised.

The malicious Claude Code extension

Detail	Information
Affected versions	2.1.312 and 2.1.313
Distribution channel	Cursor’s VS Code extension marketplace cache
Published	October 29, 2026
Exposure window	About 11 hours
Potentially affected users	Up to 5,000
Payload	Malicious JavaScript installing persistent SSH backdoors

The attackers modified the legitimate extension to run malicious JavaScript that:

• Collected system information
• Installed an attacker-controlled SSH key
• Tried to enable SSH access
• Set up persistence to keep remote access

Researchers found coding errors that likely stopped the backdoor from working on many Windows and macOS systems where SSH wasn’t already enabled. Machines where SSH was already enabled are at higher risk.

What was not affected

• Anthropic’s legitimate Claude Code extension and the Open VSX marketplace Cursor uses
• Cursor’s production infrastructure and official application releases
• Customer code repositories
• Code and prompts from users with Privacy Mode enabled

Cursor’s response
Cursor’s monitoring detected the unauthorized activity. The company revoked the Fireworks access key, rotated exposed credentials, and temporarily shut down some internal and product services as a precaution. It has since moved all inference traffic away from Fireworks, rebuilt its extension marketplace, and redeployed its production infrastructure.

Part of a wider “Black October” campaign
The incident is part of a wave of attacks on AI developer platforms that Wiz has named “Black October.” The attacks target development infrastructure to steal credentials, especially ones that give access to AI models. Stolen keys have been used for unauthorized AI inference, leaving victims with large bills, and some incidents are linked to attempts at AI model distillation.

Company	Reported impact
Railway	Customer authentication secrets stolen; about $740,000 in fraudulent AI charges
OpenCode	Exposed API keys and unauthorized AI usage
Fireworks AI	Multiple breaches, including exposed API keys and tokens, and development machines accessed via a compromised third-party cloud provider
Notion	AI chat transcripts from a small number of workspaces exposed through the Fireworks breach
Warp	AI agent logs and user telemetry data exposed
Northflank, Lightning AI	Also affected
Cursor	Internal systems breached and marketplace compromised

Why it matters
This breach shows a new kind of supply chain risk created by AI tooling. AI coding-agent traces can capture secrets, such as API keys pasted into prompts or read from files, and send them to third-party providers for training or inference. One compromised AI vendor then exposed a code editor, its internal tools, and finally its users’ machines. Developer environments are high-value targets because they hold source code, cloud credentials, and access to production systems.

Recommendations for developers

• Check whether you installed or updated the Claude Code extension in Cursor around October 29, and follow Cursor’s remediation guidance if you did.
• Inspect SSH configuration: Look for unknown keys in ~/.ssh/authorized_keys, check whether SSH was turned on unexpectedly, and look for persistence mechanisms you don’t recognize.
• Rotate credentials stored on or reachable from potentially affected machines, including SSH keys, cloud access keys, API tokens, and Git credentials.
• Enable Privacy Mode in Cursor if you don’t want your code and prompts kept or used for training.
• Never paste secrets into AI prompts, and keep credentials out of files that AI agents can read.

Recommendations for organizations

• Audit AI vendors’ data handling: Know which AI providers get your code, prompts, and agent traces, and how long they keep them.
• Scan AI logs and traces for secrets, and redact them before they leave your environment.
• Monitor AI API usage and billing for unexpected spikes that could signal stolen keys.
• Control IDE extensions: Restrict and allow-list extensions on developer machines, and watch for unexpected extension updates.
• Disable SSH on developer workstations where it isn’t needed.

We will update this post if more details about the Black October campaign emerge.