Quick Take
- What: Attackers stole credentials from Fireworks AI, accessed Cursor’s internal systems, and distributed malicious Claude Code extension versions 2.1.312 and 2.1.313 through Cursor’s VS Code marketplace on October 29.
- Who is affected: Up to 5,000 developers who installed or updated the Claude Code extension during an 11-hour window on October 29 may have received malicious builds containing SSH backdoor code.
- Data exposed: Fewer than 0.05% of users had historical AI coding-agent traces exposed, fewer than 0.01% had API credentials compromised, plus archived source code, customer support data, and product usage metrics.
- What to do: Developers who installed or updated Claude Code during the attack window should follow Cursor’s remediation guidance to check for and remove potential SSH backdoors.
- Status: Cursor has moved all inference traffic away from Fireworks, revoked exposed credentials, rebuilt its extension marketplace, and redeployed production infrastructure.
In plain English
Cursor is a code editor that uses AI to help developers write software. Hackers broke into systems used by Cursor and one of its partners, Fireworks AI. They stole login credentials and used them to push out fake, infected versions of a popular coding tool called Claude Code.
What you should do: If you installed or updated Claude Code on October 29, the fake version tried to install a backdoor on your computer that would let the hackers control it remotely. However, coding errors in the malware meant it probably did not work on most Windows and Mac computers unless you already had remote access turned on. If you are not a software developer using Cursor, you can ignore this incident.
What happened
Cursor disclosed the incident in a report published on Friday, November 14. According to the company, the attack began when hackers obtained an access key stored on Fireworks AI, a third-party provider Cursor used for AI model training and inference.
The attackers used the exposed key to copy data from a read-only storage bucket Cursor used to share information with Fireworks. This bucket contained historical AI coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode and whose data could be used for model training. Some of these traces contained unredacted API credentials.
Using the exposed credentials, the hackers accessed several of Cursor’s software-as-a-service (SaaS) tools and stole:
- Archived, non-production Cursor source code repositories, some containing business contact information
- Limited customer support information and email conversations
- Product usage metrics and customer contact details
- Summaries of some AI coding-agent conversations
- Credentials that customers had previously shared with Cursor’s support team
Cursor says fewer than 0.05% of users had coding-agent traces exposed, while fewer than 0.01% of customers had API credentials compromised.
Cursor’s monitoring systems detected the unauthorized activity, leading the company to revoke the Fireworks access key, rotate exposed credentials, and investigate additional unauthorized access. The company temporarily turned off some internal and product services as a precaution.
The malicious extension
On October 29, the attackers used a stolen credential to publish malicious copies of Anthropic’s Claude Code extension on Cursor’s VS Code extension marketplace. The attack did not compromise Anthropic’s legitimate extension or Open VSX, the extension marketplace Cursor uses.
The malicious extensions, versions 2.1.312 and 2.1.313, were available for approximately 11 hours before Cursor removed them. The attackers modified the legitimate Claude Code extension to execute malicious JavaScript that attempted to install persistent SSH backdoors on developers’ computers.
The malware collected system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and configured persistence mechanisms to maintain remote access. However, security researchers found coding errors that likely prevented the backdoor from working on many Windows and macOS systems where SSH was not already enabled.
Cursor estimates that up to 5,000 users who requested affected extension versions during the exposure window may have received the malicious builds.
What you should do
Customers who installed or updated to the affected Claude Code extension during the attack on October 29 are advised to follow Cursor’s remediation guidance to check for and remove potential SSH backdoors.
Cursor says its production infrastructure, official application releases, customer code repositories, and code and prompts belonging to users with Privacy Mode enabled were not affected.
What it means
The incident is part of a wave of attacks targeting AI developer platforms that cybersecurity company Wiz has dubbed “Black October.” These attacks targeted development infrastructure to steal authentication credentials, especially those providing access to AI models.
Stolen credentials have been used for unauthorized AI inference, generating substantial charges for affected customers, with some incidents also linked to attempts at AI model distillation.
The attacks have affected numerous companies, including Railway, Northflank, Lightning AI, OpenCode, and Warp. At Railway, attackers stole customer authentication secrets, which were later used to generate approximately $740,000 in fraudulent AI charges.
Fireworks AI disclosed multiple security breaches in October, including one involving exposed API keys and tokens and another in which attackers accessed development machines through a compromised third-party cloud provider. The Fireworks incidents also affected other customers, including Notion, which recently disclosed that AI chat transcripts from a small number of workspaces were exposed.
Cursor has moved all inference traffic away from Fireworks, revoked and rotated exposed credentials, rebuilt its extension marketplace, and redeployed its production infrastructure as a precaution.
