Cursor's November 13 account of its security incident links two events that can be easy to conflate: an intrusion involving data and credentials shared with Fireworks AI, and a malicious copy of Anthropic's Claude Code extension served from Cursor's own VS Code extension marketplace. Cursor says the first exposed credentials that were then used to reach some of its systems; one stolen credential from that access was later used to publish the tampered extension. The company says the vast majority of customers were not affected and that it has contacted people it identified as affected.
How did the incident move from Fireworks to Cursor?
Cursor says it had issued an access key to Fireworks, an outside model provider. In an October incident, an attacker obtained that key and copied data from a read-only bucket Cursor used to share material with Fireworks. The bucket held a limited number of coding-agent traces, mostly from 2025, from sessions that were not in Privacy Mode and that Cursor was permitted to use for model training. Some traces contained credentials that had not been redacted. Cursor says fewer than 0.01% of its customers had API credentials exposed in this part of the incident.
Cursor says the attacker used some of those credentials to reach selected software-as-a-service tools. Through those tools, it accessed selected archived, non-production Cursor source repositories, limited customer-support data and email conversations, product-usage metrics and contact details, summaries of some coding-agent conversations, and some credentials users had sent to Cursor support. Cursor does not say that every item in those categories was taken, and it does not give a count for each category.
That distinction matters: Cursor says customer code repositories, production systems, active inference requests, its official app updates and release-signing keys were not affected. It also says user prompts and code in Privacy Mode were not in the exposed trace data; fewer than 0.05% of users had non-Privacy-Mode traces exposed, and it says those users were individually notified. Access to selected company repositories is not the same claim as access to customers' working repositories. These boundaries and percentages are Cursor's findings from its investigation, not an independent audit of every system.
What happened to the Claude Code extension?
On October 29, someone used a credential taken from Cursor's internal systems to place unauthorized copies of Anthropic's Claude Code extension in the cache serving Cursor's VS Code extension marketplace. Cursor identifies versions 2.1.312 and 2.1.313 for Windows and macOS as malicious. It says the builds were available for about 11 hours, from roughly 2:27 a.m. to 1:35 p.m. Pacific Time, and that at most 5,000 users who requested specific cached versions may have received them. That is a company estimate of potential recipients, not a confirmed count of machines on which the malware ran.
Cursor says Anthropic did not develop or publish the copies, and that this was not a vulnerability in Anthropic's product. Microsoft independently analyzed the tampered package and confirmed that these malicious versions were not distributed through Microsoft's official Visual Studio Marketplace or the Anthropic Claude Code npm package. Microsoft also confirmed with Anthropic that Anthropic's own systems were not compromised. The affected distribution route described by both companies is Cursor's marketplace cache; that does not make every Cursor installation or every Claude Code extension unsafe.
Microsoft's analysis says the extension attempted to collect basic host details, add an unauthorized SSH key, establish remote access and create persistence. Whether remote access succeeded depended on the machine's privileges and configuration. Cursor says it removed the package and took the attacker's server offline, but also warns that uninstalling the extension alone may not remove artifacts already written to a computer. A failed connection attempt is not proof that no other changes occurred.
Which users should check?
The exposure window was narrow and tied to a specific route: a Windows or macOS machine that installed or updated Anthropic.claude-code version 2.1.312 or 2.1.313 from Cursor's VS Code extension marketplace during the October 29 window. Merely using Cursor, using another extension, or using Claude Code from Anthropic's official channel does not establish that a machine received this build. Microsoft says the official Visual Studio Marketplace and npm distribution were not affected.
Cursor says it began notifying affected users and team administrators in October, and its November update says identified affected customers were contacted directly with details relevant to them. For the extension exposure, Cursor's October notice lists the exact versions, time window and checks. Anyone whose installation history might match should follow that notice and its current remediation guidance. Do not rely only on uninstalling or updating the extension; the notice says separate persistence may remain. If an affected machine or credential is in question, use Cursor's official instructions and the issuing service's guidance, and rotate potentially exposed credentials from a trusted device.
Why is the Fireworks link relevant?
The Fireworks connection does not mean the two companies' customers faced the same exposure. Fireworks' own bulletin describes its incident and its affected accounts; Cursor's update describes Cursor data and the downstream marketplace event. VIBPS has separately covered the Fireworks incident as it related to Notion Insights transcripts. That article answers what Notion said about its dataset and workspace response; this one follows Cursor's separate trace, internal-system and extension-distribution claims. The shared upstream provider is a link between the timelines, not evidence that the affected datasets were identical.
For makers, this is a reminder that an extension marketplace can be a separate distribution boundary from the software publisher's own channel. Publisher names and familiar branding are not enough to establish that a cached package is authentic. Teams that rely on extensions should know which registry or mirror serves updates, keep installation records, restrict new publishers where practical, and have a process for investigating a specific version. Those controls reduce uncertainty; they do not replace the vendor's incident notice or endpoint review after a confirmed exposure.
Cursor's October 29 security notice: affected versions, time window and current remediation guidance
Microsoft Security: independent package analysis and confirmation of unaffected official channels
Fireworks' November 9 incident update
What did the Fireworks incident expose in Notion AI?
How to protect an app while an AI coding agent works
VIBPS is the social network for software, where makers can publish what they build and give people a way to follow their work. Security events around developer tools matter because those tools can sit close to source code, credentials and the work makers are trying to ship.