The compromise of Anthropic’s official Claude Code extension on Cursor’s extension marketplace was the result of the theft of an access key that was exposed in the wake of a breach targeting Fireworks AI.
“An attacker obtained an access key we had issued to Fireworks,” Cursor said in a Friday update. “The key was exposed by Fireworks, and the attacker used it to copy data from a read-only storage bucket we used to share data with them.”
The disclosure comes nearly two weeks after a trojanized version of Anthropic’s official Claude Code extension was distributed through Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems.
According to the artificial intelligence (AI)-powered coding platform, the read-only storage bucket is said to have contained limited coding agent traces from sessions that were not in Privacy Mode. Privacy Mode is a Cursor-specific setting that, if enabled, allows users to opt out of their data being used for training purposes.
These sessions, most of which date back to 2025, were permitted to be used for model training. Among these traces were credentials that had not been edited out, exposing the API credentials of less than 0.01% of customers in the process.
The attacker, Cursor added, used these credentials as a starting point to reach select software-as-a-service (SaaS) tools used by Cursor and then access the following data –
- Select archived non-production Cursor source code repositories, including some containing business contact information
- Limited customer support data and email conversations
- Product usage metrics and contact details
- Summaries of some coding agent conversations
- Some credentials users had sent to the Cursor support team
Cursor said it took steps to deactivate the vendor’s key, revoke and rotate credentials, and hunt for signs of deeper access, and contain it after “we identified further access.” The company also said it temporarily disabled internal and product services, disrupting access to some Cursor features.
The next phase of the attack took place on October 29, 2026, when the attacker used a stolen credential from the exposed data of its internal system to place trojanized versions of Anthropic’s Claude Code extension directly on the cache used to serve Cursor’s extension marketplace.
“At most 5,000 users who requested specific cached versions of the extension on October 29 potentially received the malicious build,” Cursor said. “It was available for approximately 11 hours before we removed it. We took it down, took the extension marketplace offline, and worked with the cloud service provider hosting the attacker’s server to take it down.”
The company said it notified affected users who installed versions 2.1.312 or 2.1.313 from the marketplace during the exposure window and helped revoke exposed credentials. It has also moved all inference traffic off Fireworks, deactivated the key issued to it, and cut off its access to all data sets we shared with it.
Furthermore, Cursor emphasized that no additional malicious activity has been detected since November 1, 2026.
There is no evidence that the incident impacted users who had enabled Privacy Mode, customer code repositories, Cursor’s own production environment, Cursor app and its official updates, its other apps, or any other extension or plugin downloaded from Cursor Marketplace.
Uber Also Impacted by Fireworks Incident
The development comes as Uber confirmed unknown threat actors stole thousands of drivers’ license information after obtaining internal credentials.
“On October 9, 2026, a service provider notified Uber that an unauthorized third-party had compromised the service provider’s internal credentials and used them to access Uber’s account with the service provider,” the company said in a filing with the U.S. state of California. “On October 13, 2026, our investigation determined that the unauthorized party had used the compromised credentials to access Uber data connected to the service provider.”
Although the name of the provider was not disclosed, TechCrunch reported that the provider in question is Fireworks AI. Uber has not disclosed how many users were impacted by the breach. Last week, online productivity startup Notion also confirmed its data was stolen in the Fireworks AI hack.