Cursor Breach Exposed 5,000 Developers to Malicious Claude Code

Up to 5,000 developers received malicious Claude Code extensions after a breach of Cursor's systems, the company confirmed in an incident report published Friday. The malware ran on the marketplace for approximately 11 hours on October 29.

Cursor is an AI-powered code editor built on Microsoft's open-source VS Code. Attackers began by stealing an access key from Fireworks AI, a third-party provider Cursor used for AI model training and inference. The key opened a read-only storage bucket Cursor shared with Fireworks.

That bucket held historical AI coding-agent traces, mostly from 2025, from users who had not enabled Privacy Mode. Some traces contained unredacted API credentials. Attackers used those credentials to reach additional Cursor systems. Cursor says fewer than 0.05% of users had traces exposed, and fewer than 0.01% of customers had API credentials compromised — a fraction of the user base, but enough to chain the attack further.

What did the attackers steal?

Using the exposed credentials, the hackers pulled data from several of Cursor's SaaS tools. The stolen material included:

• Archived, non-production source code repositories, some containing business contact information
• Limited customer support information and email conversations
• Product usage metrics and customer contact details
• Summaries of some AI coding-agent conversations
• Credentials customers had previously shared with Cursor's support team

Cursor's monitoring detected the unauthorized activity. The company revoked the Fireworks key, rotated exposed credentials, and shut down some internal and product services as a precaution. But one credential — the one that mattered most — had already slipped out.

How did the malicious extension reach users?

On October 29, the attackers used a stolen credential to place malicious copies of Anthropic's Claude Code extension directly on the cache serving Cursor's VS Code extension marketplace.

"On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace," Cursor explained in its report.

The malicious builds, versions 2.1.312 and 2.1.313, modified the legitimate extension to execute malicious JavaScript. The malware collected system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and configured persistence mechanisms for remote access. Security researchers found coding errors that likely prevented the backdoor from working on many Windows and macOS systems where SSH was not already enabled — a lucky failure, not a designed defense.

Anthropic's legitimate extension and Open VSX, the marketplace Cursor uses, were not compromised. Cursor says production infrastructure, official application releases, customer code repositories, and all data from Privacy Mode users remained unaffected.

What is Cursor doing now?

The company has moved all inference traffic away from Fireworks, revoked and rotated exposed credentials, rebuilt its extension marketplace, and redeployed production infrastructure as a precaution. Customers who installed or updated the affected Claude Code extension versions during the attack window should follow Cursor's remediation guidance.

The report does not specify how long attackers held the initial Fireworks key before detection, nor whether the stolen support credentials have been traced to downstream compromises — gaps that matter for any customer doing post-incident review.

Is this part of a broader campaign?

Yes. Security company Wiz has dubbed the wave of attacks on AI developer platforms "Black October." The campaign targets development infrastructure to steal authentication credentials, especially those granting access to AI models. Stolen credentials have funded unauthorized AI inference, generating substantial charges, with some incidents linked to attempts at AI model distillation.

Affected companies include Railway, Northflank, Lightning AI, OpenCode, and Warp. At Railway, attackers stole customer authentication secrets later used to generate approximately $740,000 in fraudulent AI charges — nearly three-quarters of a million dollars from one victim. OpenCode also reported exposed API keys and unauthorized AI usage.

Fireworks AI itself disclosed multiple October breaches: one involving exposed API keys and tokens, and another in which attackers reached development machines through a compromised third-party cloud provider. Those incidents hit other Fireworks customers too. Notion recently disclosed that AI chat transcripts from a small number of workspaces were exposed.

For enterprises, the lesson is narrow and uncomfortable: AI coding-agent traces are an attack surface. Any tool that logs sessions containing live credentials, and shares them with third-party inference providers, inherits the weakest link in that chain.