Cursor on November 13 published a detailed update on the security incident it first disclosed at the end of October, saying the intrusion began with an access key the company had issued to Fireworks. According to the Cursor Team, that key was exposed by Fireworks and then used to copy data from a read-only storage bucket Cursor had used to share material with the vendor. The post is the company's most complete public account so far of how a malicious copy of Anthropic's Claude Code extension reached Cursor's own VS Code marketplace, and of what customer data Cursor now believes was involved.
Cursor says the bucket held a limited set of coding-agent traces, mostly from 2025, taken from sessions that were not running in Privacy Mode and that Cursor was permitted to use for model training. A small number of those traces, the company says, still contained credentials that had not been redacted, and less than 0.01 percent of customers had API credentials exposed this way. Starting from those credentials, Cursor says the attacker reached selected SaaS tools used inside the company and, from there, obtained archived non-production source-code repositories (some of which included business contact information), limited customer-support data and email conversations, product-usage metrics and contact details, summaries of some coding-agent conversations, and some credentials that users had sent to Cursor's support team.
Cursor says its monitoring systems identified the unauthorized activity, after which it deactivated the vendor key, opened an incident-response effort, and began rotating credentials and searching for further access. As a precaution, the company says it temporarily disabled internal and product services beyond what the evidence required, which briefly disrupted some Cursor features, and restored each service once it judged that safe. The November 13 post says the last attacker activity Cursor has seen was on November 1, and that this activity was blocked.
The most visible part of the incident was already public. On October 29, Cursor published a security notice saying that between about 2:27 a.m. and 1:35 p.m. Pacific Time that day, malicious builds of Anthropic.claude-code versions 2.1.312 and 2.1.313 were available in the Cursor VS Code extension marketplace and attempted to install a persistent SSH backdoor. The November 13 update now says the attacker used a stolen credential from the exposed internal data to place those unauthorized copies directly on the cache that served the marketplace. Cursor says Anthropic did not publish the copy, the issue was not a vulnerability in Anthropic's product, and Open VSX, the upstream marketplace source, never carried the malware. It estimates that at most 5,000 users who requested specific cached versions on October 29 could have received the malicious build, which was available for about 11 hours before Cursor removed it and took the marketplace offline. Microsoft's Security team, writing on October 30, independently described the same marketplace window and the SSH-backdoor behavior, and said the malicious packages were not published on the Microsoft Visual Studio Marketplace or on npm. Microsoft also said Anthropic had confirmed that its own systems were not compromised.
Cursor says the vast majority of customers were not affected and that it has contacted each affected customer with the details that apply to them. In the November 13 post it states that prompts and code were not exposed for users of Privacy Mode; that coding-agent traces were exposed for fewer than 0.05 percent of users who were not using Privacy Mode, all of whom were notified; and that live traffic, production systems, official Cursor app updates, release-signing keys, other marketplace extensions, Cloud Agents, Grok Bot, and other SpaceX SI products were not involved. Cursor also says it has moved all inference traffic off Fireworks, rotated exposed and, as a precaution, other internal credentials, rebuilt the marketplace, added broader secret scanning, redeployed production infrastructure, and engaged external forensics experts.
The company's account attributes the starting point to a key "exposed by Fireworks." Fireworks had already disclosed an October 2026 intrusion that reached its development systems and exposed some customer billing data and datasets; Notion later said Insights chat transcripts were among the impacted material. Those earlier disclosures did not describe Cursor's customer-data scope or the marketplace malware, and Cursor's November 13 post does not explicitly identify its vendor-key exposure as the same Fireworks incident. The impact percentages, the list of systems reached, and the claim that the incident is contained remain Cursor's own findings. Customers who installed or updated to the tampered Claude Code builds during the October 29 window are still asked to follow the remediation steps in Cursor's original security notice, which warned that uninstalling the extension alone may not be enough because the payload could leave separate persistence artifacts.