- Cursor says an incident that began with a key exposed by its vendor Fireworks ended with a fake Claude Code extension in its marketplace for about 11 hours.
- Cursor says exposed AI coding traces contained some unredacted credentials, and those credentials let the attacker reach more of its systems.
- Leaders should ask which vendors receive AI coding transcripts, how secrets are removed from them, and whether developers installed versions 2.1.312 or 2.1.313.
An AI coding session leaves a record that needs protecting
When a developer asks an AI assistant for help, the session leaves a record. It holds the prompts and the code. Credentials can end up in such records too, as Cursor's new incident report shows.
Cursor is an AI-powered code editor. Its report describes a fake version of Anthropic's Claude Code add-on that sat in its marketplace on October 29. The attack began with a vendor's exposed key and stored AI coding traces.
What Cursor says happened
Cursor says the trouble began at Fireworks, a vendor it shared data with. Cursor says Fireworks exposed an access key that Cursor had issued to it. An attacker used that key to download files from a shared storage area. The area could be read but not changed.
This is Cursor's account. The sources include no comment from Fireworks.
Cursor says the storage held a limited set of coding agent traces, mostly from 2025. They came from users who had not turned on Privacy Mode. Cursor was allowed to use that data to train models.
Some of those traces, Cursor says, still held live credentials that no one had scrubbed out. Scrubbing here means blacking out secrets before data is stored or shared. Cursor says fewer than one in 10,000 customers had API credentials exposed. The attacker used those credentials to get into some outside software services that Cursor uses.
Through those services, Cursor says, the attacker viewed old non-production code repositories and limited support records. The list also includes product usage figures, contact details and summaries of some coding agent chats. Some credentials that users had sent to Cursor support were reached too.
How the fake extension reached users
Cursor says the attacker used a stolen credential from data taken from its internal systems. The report does not say whether that credential came from the traces.
On October 29, Cursor says, the attacker used it to place fake copies of the Claude Code extension on the cache behind Cursor's marketplace. A cache is a stored copy that is handed out so the original need not be fetched each time.
Cursor says Anthropic did not publish the fake. It also says the case was not a flaw in Anthropic's product. Open VSX, the marketplace source, never held the malware.
Cursor puts the exposure at up to 5,000 users. These are people who asked for particular cached versions that day. The builds were 2.1.312 and 2.1.313. They stayed up for about 11 hours.
BleepingComputer reports that the code tried to set up lasting SSH backdoors. SSH is a standard way to log in to a computer from afar. The malware gathered system details and added a key the attacker controlled. BleepingComputer adds that researchers found bugs in the malware. Those bugs probably blocked the backdoor on many Windows and macOS computers unless SSH was already on.
The lesson: AI session data deserves the care of a password store
Look at what Cursor describes. It describes no clever attack on its core product. It describes an exposed key, a shared storage area, stored traces and then stolen credentials.
In our view, this shows that an AI coding session is a running log of how people build and connect systems. Cursor says some of those logs held unredacted credentials.
In our view, redaction should be a control that someone proves, not one that people assume. Cursor does not describe how it redacted traces. It says only that some credentials were left in.
This is one incident, reported by the affected company. But the question applies widely. Data shared with a vendor is only as safe as that vendor's handling of keys.
Cursor says prompts and code from Privacy Mode users were not exposed. Of users outside Privacy Mode, it says under 0.05% had traces exposed. It says it told each of them directly. Cursor also says production systems, official app releases and customer code repositories were not affected. It adds that no release signing keys were exposed.
What Cursor has changed
Cursor says it moved all inference traffic away from Fireworks. It also disabled the key and ended that vendor's access to shared data. It rotated every exposed credential it found. As a precaution, it rotated all credentials used across its internal systems.
Cursor says it rebuilt its extension marketplace and checked that other extensions were authentic. It added network limits so stolen credentials cannot be used from other places, where possible. It also added secret scanning across its code repositories. Cursor says the last attacker activity was on November 1 and was blocked. It believes the incident is contained.
Questions to put to your team
First, check developer machines. Did anyone get the Claude Code extension, build 2.1.312 or 2.1.313, through Cursor's marketplace that day? Cursor says removing the extension may not be enough. It points affected users to the steps in its security notice.
Second, ask which vendors receive your developers' AI session data. Ask whether any of it is used for training. Third, ask how secrets are stripped from that data. Ask who checks that the stripping works.
Fourth, ask whether keys given to vendors only work from approved network locations. Cursor lists that step among its own fixes.
The lesson is plain. An AI session record can hold credentials, so it needs the same care as a password store.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cursor (Anysphere).
