Cursor says stolen Fireworks AI credentials led to malicious Claude Code extensions

Up to 5,000 Cursor users may have received malicious builds of Anthropic’s Claude Code extension after intruders using stolen Fireworks AI credentials published tainted versions 2.1.312 and 2.1.313 on Cursor’s VS Code extension marketplace on Oct. 29, 2026, Cursor confirmed.

Cursor, an AI-powered code editor built using Microsoft’s open-source Visual Studio Code, said the attack began with an access key taken from Fireworks AI, a provider the company used for model training and inference. Using that key, they copied information stored in a read-only bucket shared between Cursor and Fireworks. Those traces were historical AI coding-agent records from 2025 belonging to users outside Privacy Mode, and some contained unredacted API credentials. Cursor said fewer than 0.05% of users had coding-agent traces exposed, and fewer than 0.01% of customers had API credentials compromised.

With those credentials, the intruders reached Cursor’s software-as-a-service tools, where they accessed archived non-production source code repositories, limited support records and emails, usage metrics, contact details, conversation summaries, and customer credentials held by support. When monitoring systems spotted the unauthorized activity, Cursor revoked the Fireworks access key, rotated exposed credentials, and investigated further unauthorized entry. During the investigation, Cursor temporarily shut down some internal and product services as a precaution.

Earlier, intruders had obtained a separate credential that let them publish extensions on Cursor’s marketplace. On Oct. 29, 2026, they used it to post the malicious Claude Code packages. They stayed up from roughly 9:27 a.m. until 8:35 p.m. UTC, which was about 2:27 a.m. to 1:35 p.m. Pacific time. Cursor took the extensions down after roughly 11 hours and shut down the marketplace that day to review every other extension.

Cursor said it examined all other extensions, found no tampering, and brought the marketplace back. Cursor estimated that as many as 5,000 users who requested affected versions during the exposure window might have received malicious builds, but said this was a potential distribution count rather than confirmation of 5,000 successful backdoor connections. Cursor said it blocked the last activity it observed from the attacker on Nov. 1, 2026, and believes it has contained the incident.

The tainted extension collected host information and established persistence (mechanisms that keep the code running on the machine) using a macOS LaunchAgent or a Windows scheduled task with a Startup-folder fallback, then retried a reverse tunnel to 134.209.82.225 about every 60 seconds. Coding errors and missing administrator rights prevented the tunnel on most Windows and macOS machines, yet the extension still added an SSH key labeled svc-telemetry and transmitted host details to the attacker. The loader executed as soon as the extension module loaded, with no Claude conversation required.

The first beacon transmitted environment variable names but not their values, a detail that can show which cloud providers and credential types a machine has configured. The attacker’s infrastructure used endpoint 134.209.82.225, a reverse SSH target on TCP port 22, and a beacon on port 8099. Cursor’s impact check searches the SSH authorized_keys file for the attacker’s public key labeled svc-telemetry.

The company revoked and rotated exposed credentials, rebuilt its extension marketplace, and arranged for its cloud provider to remove the attacker’s server. As a precaution, Cursor redeployed production infrastructure and expanded secret scanning and network restrictions. Cursor said its production systems, official app releases, customer code repositories, and Privacy Mode users’ code and prompts were not affected.

Cursor said users should follow its remediation guidance because removing the extension may not remove all payload artifacts. Cursor published remediation scripts called remediate-macos.sh and remediate-windows.ps1 and instructed users to isolate hosts, remove SSH keys and persistence, rotate credentials, and consider rebuilding affected machines.

Anthropic confirmed that a malicious actor accessed Cursor’s marketplace and published a compromised extension, while saying its own systems were not breached.