Cursor breach let attackers plant a malicious Claude Code extension on its marketplace

Cursor has confirmed that a breach let attackers distribute malicious copies of Anthropic's Claude Code extension through its own marketplace 1

1

. In an incident report published Friday, November 14, the company dated the malicious builds to October 29, when they sat on the cache serving its VS Code extension marketplace for about 11 hours 1

1

.

How the attackers got in

The chain started away from Cursor. Fireworks AI, an AI infrastructure provider Cursor used for model training and inference, disclosed multiple breaches in October 1

1

2

2

. A key Cursor had issued to Fireworks was exposed in one of them 1

1

2

2

. Attackers used it to copy the contents of a read-only storage bucket the two companies shared 1

1

2

2

.

The bucket held historical coding-agent traces, mostly from 2025, from users who had not turned on Privacy Mode, the setting Cursor offers to opt out of having data used for training 1

1

2

2

. Some of those traces contained unredacted API credentials, and the attackers used them to reach Cursor's other systems 1

1

.

From there, data came out of several Cursor tools 1

1

2

2

. The haul included archived non-production source code repositories, some with business contacts, along with limited support data and emails 1

1

2

2

. Attackers also took product usage metrics and contact details, plus summaries of some coding-agent conversations and credentials customers had shared with support 1

1

2

2

. Per Cursor, those traces were exposed for under 0.05% of users 1

1

. It puts compromised API credentials below 0.01% of customers 2

2

.

The poisoned extension

Per Cursor's incident report, "On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace" 1

1

. Versions 2.1.312 and 2.1.313 were affected, and Anthropic's legitimate extension was not 1

1

2

2

.

The malicious build ran JavaScript to collect system information, install an attacker-controlled key for SSH, the standard protocol for remote logins, and set up a persistent backdoor 1

1

. Researchers found coding errors that likely kept the backdoor from working on many systems where SSH was not already switched on 1

1

. Cursor estimates that at most 5,000 users who requested the affected versions in that window may have gotten the malicious builds 2

2

.

Cursor says its production infrastructure was not affected, along with official app releases, customer code repositories and the data of Privacy Mode users 1

1

2

2

. It also says the Open VSX marketplace was untouched 1

1

2

2

.

The cleanup

Cursor says its monitoring detected the unauthorized activity, which prompted the key revocation, credential rotation and investigation 1

1

. Cursor has since revoked and rotated credentials, moved all inference traffic off Fireworks and deactivated the exposed key 1

1

2

2

. It cut Fireworks' access to shared datasets, rebuilt the marketplace, temporarily disabled some services and worked with a cloud provider to knock the attacker's server offline 1

1

2

2

. It has notified affected users and helped revoke exposed credentials 2

2

.

Black October

The breach sits inside a wider pattern. Security firm Wiz dubbed the cluster "Black October": a wave of attacks on AI developer platforms aimed at stealing credentials for AI model access 1

1

. The victims include Railway, Northflank, Lightning AI, OpenCode and Warp 1

1

. At Railway, stolen customer authentication secrets were used to run up roughly $740,000 in fraudulent AI charges 1

1

. Fireworks' October breaches also touched its own customers, including Notion, where AI chat transcripts from a handful of workspaces were exposed 1

1

2

2

. Per a California filing and TechCrunch reporting, thousands of Uber drivers' license numbers were stolen through compromised provider credentials, with Uber notified on October 9 2

2

. Cursor, for its part, says it has detected no further malicious activity since November 1 2

2

.