An access key exposed by supplier Fireworks AI opened the way for a sequence of unauthorized accesses that ended in the distribution of tampered versions of the Claude Code extension in Cursor's marketplace. The chain of compromise was detailed by the company on November 13, two weeks after the incident that may have exposed up to 5,000 users to malicious files.
The report clarifies how the attacker moved from an external integration to Cursor's internal tools and later to the infrastructure responsible for distributing extensions to developers. The company says it contained the attack and notified affected customers directly.
Supplier credential was the first link in the breach
According to the investigation, the attacker obtained a key that Cursor had provided to Fireworks AI. The credential allowed copying data from a storage shared with the supplier, used to make historical records of coding agents available for model training.
These records, mainly from 2025, belonged to sessions held outside Privacy Mode. Part of them contained credentials that had not been removed before storage.
With this information, the attacker was able to access certain corporate services used by Cursor. Among the materials reached were archived repositories of code not used in production, limited support data, email conversations, usage metrics and summaries of interactions with agents.
In a later stage, using another credential obtained from internal data, the attacker was able to insert malicious copies of the Claude Code extension directly into the cache responsible for serving requests from the Cursor marketplace.
The alteration did not occur in Anthropic's official distribution nor in Open VSX, the repository used as the source by the marketplace. Microsoft, which independently analyzed the malicious code in October, confirmed that the tampered packages were also not distributed by the official Visual Studio Marketplace.
Up to 5,000 users may have received tampered versions
The versions involved were `Anthropic.claude-code 2.1.312` and `2.1.313`, made available on October 29 for approximately 11 hours.
According to Cursor, up to 5,000 users requested versions stored in the compromised cache and may have received the modified files. The number represents the potential reach of the distribution, not a confirmation that all those devices were compromised.
The technical analysis published by Microsoft identified code capable of collecting information from the computer, adding an SSH key controlled by the attacker and attempting to establish a persistent remote connection. The successful execution of these actions depended on the permissions and configuration of each machine.
As for the exposure of internal data, Cursor says that fewer than 0.01% of its customers had API credentials exposed. Agent records were accessed for fewer than 0.05% of users outside Privacy Mode.
The company maintains that its production systems, customer code repositories, official application updates and data protected by Privacy Mode were not compromised.
Cursor reinforces controls and advises affected users
After identifying the suspicious activity, the company revoked credentials, cut off Fireworks' access to the shared data and moved its inference traffic to other suppliers. It also rebuilt the marketplace, expanded security checks and hired external experts to support the investigation.
The last activity attributed to the attacker was identified and blocked on November 1. Cursor considers the incident contained, although it continues monitoring its systems.
Users who installed or updated the affected versions from the Cursor marketplace during the exposure period should follow the instructions in the security notice published on October 29.
The guidance includes checking for indicators of compromise, removing possible persistence mechanisms and replacing potentially exposed credentials. Uninstalling the extension alone may not eliminate the malicious components left on the computer.
