Cursor confirms security breach led to malicious Claude Code extension

Summary

Cursor confirmed a breach that escalated from credentials stored at its AI infrastructure provider, Fireworks AI, into internal data theft and malicious software distribution. According to Cursor's account reported by BleepingComputer, attackers used an exposed access key to copy a shared read-only storage bucket, recovered additional credentials from historical AI coding-agent traces, and subsequently obtained a credential permitting extension distribution through Cursor's marketplace cache.^[0]

On October 29, 2026, the attackers placed malicious copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, on that cache. The builds remained available for approximately 11 hours. Cursor estimated that up to 5,000 users who requested the affected versions may have received them; that figure is potential delivery exposure, not a confirmed count of successful backdoor installations. The modified extension attempted to establish persistent SSH access, although reported coding errors likely limited success on many Windows and macOS systems where SSH was not already enabled.^[0]

The data exposure extended beyond extension delivery. The copied bucket held traces mostly from 2025, collected from users without Privacy Mode enabled, and some contained unredacted API credentials. Cursor reported trace exposure affecting fewer than 0.05% of users and API-credential compromise affecting fewer than 0.01% of customers. Attackers also stole information from SaaS tools, including archived non-production repositories, limited support records and email conversations, usage metrics, contact details, coding-agent conversation summaries, and credentials previously supplied to support.^[0]

Cursor reported removing the malicious builds, revoking and rotating exposed credentials, moving inference traffic away from Fireworks, rebuilding its extension marketplace, and redeploying production infrastructure as a precaution. It said Anthropic's legitimate extension, Open VSX, production infrastructure, official application releases, customer code repositories, and Privacy Mode users' code and prompts were not affected. These incident-specific findings are supported by the supplied BleepingComputer report; the linked Cursor notices were not supplied as source bodies.^[0]

Attack chain

1. 1. Obtain third-party-held access credential: Attackers obtained an access key stored at Fireworks AI, which Cursor used for AI model training and inference. The supplied account does not explain how that particular key was initially stolen.^[0]
2. 2. Copy shared historical trace data: The attackers used the key to copy a read-only storage bucket Cursor used to share information with Fireworks. It contained historical coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode.^[0]
3. 3. Reuse embedded credentials and steal SaaS data: Unredacted API credentials in the copied traces enabled access to additional Cursor systems. Attackers then stole data from several SaaS tools, including archived non-production repositories, support information, customer contact and usage data, conversation summaries, and credentials previously shared with support.^[0]
4. 4. Acquire extension-distribution access: Among the exposed internal data, attackers obtained a credential that allowed them to distribute extensions through Cursor's marketplace. Cursor's initial revocation and investigation efforts did not prevent subsequent use of this already-obtained credential.^[0]
5. 5. Distribute trojanized Claude Code builds: On October 29, attackers placed unauthorized Claude Code versions 2.1.312 and 2.1.313 directly on the cache serving Cursor's VS Code extension marketplace. The malicious builds were available for approximately 11 hours before removal.^[0]
6. 6. Attempt persistent SSH access on developer systems: The modified extension executed malicious JavaScript that collected system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and configured persistence. Reported implementation errors likely prevented the backdoor from working on many Windows and macOS systems without SSH already enabled.^[0]

Disclosure timeline

How it works

The reported initial access mechanism was credential abuse. A key stored at Fireworks permitted reading a shared storage bucket. Although the bucket was read-only, its contents included reusable secrets, allowing attackers to turn data access into access to additional systems. The report does not identify a software vulnerability or CVE as the mechanism for this progression.^[0]

The extension-distribution compromise occurred at Cursor's serving cache. A credential recovered from exposed internal data allowed attackers to place unauthorized extension copies directly on that cache. This distinction matters to scope: the report explicitly states that neither Anthropic's legitimate extension nor Open VSX was compromised.^[0]

The endpoint payload was malicious JavaScript added to the legitimate Claude Code extension. It attempted to establish persistent remote access by installing an attacker-controlled SSH key, enabling SSH, and configuring persistence, while also collecting system information. Researchers reportedly identified coding errors likely to impair the backdoor on many Windows and macOS hosts where SSH was not already enabled; the evidence does not quantify successful installations.^[0]

Affected versions and patch status

Key takeaways

• Read-only storage access was sufficient to enable further compromise because historical coding-agent traces contained reusable credentials. The key escalation was from exposed data to additional authenticated access.^[0]
• The software-delivery compromise was specific to Cursor's marketplace-serving cache. It should not be characterized as a reported compromise of Anthropic's legitimate extension, Open VSX, or Cursor's official application releases.^[0]
• Up to 5,000 potential recipients is not a confirmed infection or successful-backdoor count. Researchers' reported implementation findings further limit conclusions about successful SSH access.^[0]
• The supplied evidence provides affected extension versions and behavioral leads, but no literal attacker SSH key, malicious file hash, or attacker-controlled host suitable for an actionable IOC list.^[0]
• The incident was reported amid the broader AI developer-platform breach wave described as Black October. The supplied reporting establishes that broader context, but does not establish a shared named actor or a common motive for Cursor and the other listed incidents.^[0][4]

Defensive actions

• Identify endpoints that installed or updated Claude Code through Cursor to versions 2.1.312 or 2.1.313 during the reported exposure window, and follow Cursor's incident-specific remediation guidance.: Cursor specifically directed affected installers and updaters to its remediation guidance. Exposure was tied to malicious copies served through Cursor's cache for approximately 11 hours, rather than a reported compromise of every Claude Code distribution channel.^[0]
• On potentially exposed endpoints, investigate unexpected SSH authorization changes, attempts to enable SSH access, and newly configured persistence.: These checks target the reported payload behavior: installation of an attacker-controlled SSH key, attempted SSH enablement, and persistence configuration. Reported coding errors mean payload delivery and successful remote-access establishment must be assessed separately.^[0]
• Revoke and rotate credentials confirmed exposed in affected coding-agent traces or support records.: The intrusion progressed through reuse of unredacted credentials in historical traces, and stolen SaaS data also included credentials previously shared with support. Cursor reported revoking and rotating exposed credentials as part of its response.^[0]
• Scope data exposure separately from endpoint malware exposure, distinguishing historical traces, SaaS-held customer information, and affected extension installations.: The report describes distinct affected populations and datasets: trace exposure below 0.05% of users, API-credential compromise below 0.01% of customers, additional SaaS data theft, and up to 5,000 potential malicious-extension recipients. Those figures are not interchangeable measures of impact.^[0]