What happened
Cursor says the incident began when an attacker obtained an access key Cursor had issued to Fireworks. Fireworks exposed the key, which the attacker used to copy data from a read-only storage bucket Cursor used to share data with the vendor. The bucket held a limited set of coding-agent traces, mostly from 2025, from sessions outside Privacy Mode that Cursor says it was permitted to use for model training. A small number of traces contained credentials that had not been redacted. Cursor estimates that fewer than 0.01% of customers had API credentials exposed.
Using credentials from that data, the attacker reached selected SaaS tools used by Cursor. From there, Cursor says, the attacker accessed selected archived, non-production source-code repositories, some with business contact information; limited customer-support data and email conversations; product-usage metrics and contact details; summaries of some coding-agent conversations; and some credentials users had sent to Cursor support. Cursor’s monitoring identified unauthorized activity. The company deactivated the vendor key, opened an incident-response workstream, and revoked or rotated credentials as it investigated and cut off further access. It temporarily disabled some internal and product services beyond what it says the evidence required, disrupting certain features until they were restored.
On October 29, an attacker used a stolen credential from Cursor’s internal system to place unauthorized copies of Anthropic’s Claude Code extension on the cache serving Cursor’s VS Code extension marketplace. Cursor says Anthropic did not publish the copies and that this was not a vulnerability in Anthropic’s product; Open VSX, the marketplace source, never contained the malware. At most 5,000 users who requested specific cached versions that day potentially received the malicious build. Versions 2.1.312 and 2.1.313 were available for about 11 hours before removal. Cursor took the extension marketplace offline and worked with the cloud provider hosting the attacker’s server to take it down.
Cursor says it notified affected users and team administrators, including by email and in-app notices. It asked teams whose credentials were exposed to rotate specific keys and requested revocation from the services that issued those credentials. It believes the incident is contained; the last attacker activity it saw was on November 1 and was blocked. The company says it moved inference traffic off Fireworks, rotated credentials, reviewed and rebuilt the marketplace, expanded network restrictions and secret scanning, redeployed production infrastructure, and engaged external forensic experts. It says Privacy Mode prompts and code, customer repositories, production systems, active inference requests, official Cursor releases and other marketplace extensions were not affected.
What the archive adds
New Runtime’s earlier coverage on October 30 reported that malicious Claude Code extension versions 2.1.312 and 2.1.313 appeared in Cursor’s marketplace, with Cursor initially saying at most 5,000 users were affected (earlier coverage). This is a new fact on a known story: Cursor now describes the access path, broader data exposure, remediation and its current assessment of containment.
Trend signal
This incident supports the security pattern that protection must extend to the runtime and connected systems, not rely on prompts or product boundaries alone. Cursor describes credentials moving across a vendor data-sharing path, SaaS tools and an extension-serving cache. The connection is relevant to agent security moving to runtime boundaries, though the incident is a concrete case, not proof that all agent systems share this exposure.
Why now
Cursor’s update, dated November 13, follows an October 29 security notice and says the company spent the intervening two weeks investigating. The timing matters because the new account adds an incident chain and affected-data categories beyond the initial disclosure, while the company says it has contacted affected customers directly.
Why it matters
For teams building with coding agents, the incident makes a supply-chain question concrete: a credential issued for one vendor integration can become a route to internal systems, and a separate credential can be used to alter what developers install. The reported issue was not a flaw in Claude Code itself, nor did the malware enter Open VSX; the relevant delivery point was Cursor’s marketplace cache.
The immediate operational lesson is to treat vendor access, stored traces and extension delivery as connected security surfaces. Teams should know which credentials are shared with providers, how those credentials are scoped and rotated, and how to verify extensions from the marketplace they actually use. Cursor’s figures are company estimates, but the affected version numbers and exposure window give users specific checks to apply.
Limits and uncertainty
The account is Cursor’s investigation and has not been independently verified here. Cursor gives upper-bound or percentage estimates for potentially exposed users, but does not quantify the number of affected customers or disclose how many credentials or records the attacker actually copied. It says the vast majority of customers were not affected and that affected people were contacted directly; the full forensic findings and any subsequent changes to that assessment are not described in this update. The company says it believes the incident is contained and continues monitoring, which is not the same as a guarantee that no further evidence will emerge.
Skill to build now
This week, inventory the credentials your coding tools share with external vendors and map each key to its purpose, scope, owner and rotation path. Then check whether your team installed Claude Code extension versions 2.1.312 or 2.1.313 from Cursor’s marketplace during the reported exposure window. If so, follow Cursor’s security notice rather than assuming removal alone is sufficient.
Reader takeaway
Cursor’s update links a third-party key exposure to internal data access and a malicious extension served through its marketplace. The practical response is to verify the specific affected versions and notices, and to review how narrowly vendor credentials and extension delivery are controlled.