Cursor Fireworks Incident: Agent Traces, Stolen Credentials, and a Tampered Claude Code Extension

On November 13, 2026, Cursor published a forensic update for the October incident that tied together two alarms many developers saw separately: a tampered Claude Code VS Code extension on Cursor’s marketplace cache and the wider Fireworks AI October breach that also hit Notion, Uber, and other Fireworks customers. Cursor says an attacker obtained a vendor access key Cursor had issued to Fireworks, copied historical coding-agent traces from a read-only bucket, found unredacted API credentials in a sliver of those traces, pivoted into Cursor SaaS tools, and used a stolen credential to place malicious Anthropic.claude-code 2.1.312 and 2.1.313 builds on the marketplace cache for roughly 11 hours on October 29. If you run Cursor, turn on Privacy Mode for sensitive work, run the svc-telemetry SSH check if you updated the extension that day, and rotate keys if Cursor notified you.

explainx.ai has the full news timeline for Fireworks customer fallout the same week Cursor named its vendor in the attack chain.

TL;DR

Attack chain (verified from Cursor’s November 13 post)

Cursor lists five phases. The numbers below track its wording on cursor.com/blog/security-incident-update; trade coverage on November 13–14 (for example Unite.AI’s summary) adds no new scope beyond what Cursor published.

Phase 1 — Fireworks-exposed vendor key and agent traces

1. An attacker obtained a Cursor-issued access key for Fireworks.
2. Fireworks exposed that key (Cursor attributes exposure to the vendor, not to an Anthropic or Open VSX flaw).
3. The attacker used the key to copy data from a read-only storage bucket Cursor used to share material with Fireworks for model training.
4. That bucket held limited coding-agent traces, mostly from 2025, from sessions not in Privacy Mode, which Cursor says it was permitted to use for training.
5. A small fraction of traces held credentials that were not redacted; less than 0.01% of customers had API credentials exposed in traces.

This step links directly to Fireworks’ November 9 bulletin, which confirmed datasets, billing data, and secrets for other customers in the same October campaign. Cursor is the first coding-agent IDE to publish how its training-share bucket fed the same credential-theft pattern Wiz documented across Black October.

Phase 2 — Pivot through Cursor SaaS

Starting from credentials in traces, the attacker reached select SaaS tools Cursor uses internally. Cursor says access included:

• Archived non-production source repositories (some with business contact information)
• Limited customer support data and email threads
• Product usage metrics and contact details
• Summaries of some coding-agent conversations
• Credentials users had sent to Cursor support

Cursor’s monitoring detected unauthorized activity, deactivated the Fireworks key, opened incident response, and rotated credentials as it found further access. It temporarily disabled internal and product features beyond what evidence required, which disrupted some Cursor features until each service was restored.

Phase 3 — Malicious Claude Code extension on the marketplace cache

On October 29, using a stolen credential from the exposed internal data, the attacker placed unauthorized copies of Anthropic’s Claude Code extension on the cache serving the Cursor VS Code extension marketplace:

Cursor removed the builds, took the marketplace offline, and worked with the hosting provider for the attacker server.

Phase 4 — Customer notification (October 30 onward)

On October 30, Cursor published its security notice with IOCs and remediation scripts, emailed team admins about specific keys to rotate, and asked third-party issuers to revoke exposed credentials. It notified users who may have installed the tampered extension versions during the window.

Phase 5 — Containment

Cursor believes the incident is contained: last attacker activity it saw was November 1, and that activity was blocked.

What was not affected

Cursor’s November 13 post lists explicit negatives worth keeping in runbooks:

• Privacy Mode prompts and code
• Live traffic currently sent to Cursor (exposed data was historical offline storage)
• Production systems that run Cursor
• Official Cursor app updates and release signing keys (separate code hosting; attacker did not reach it)
• Customer code repositories
• Other extensions in the marketplace (validated authentic; marketplace reviewed and rebuilt)
• Active inference requests (Cursor moved all inference off Fireworks)
• Cursor Marketplace plugins (distinct from the VS Code extension cache path)
• Cloud Agents, Grok Bot, and other SpaceX SI products (Cursor’s naming in the post)

What Cursor changed

From the same update, Cursor’s remediation stack includes:

• Moved all inference traffic off Fireworks, deactivated the vendor key, and cut off Fireworks access to shared datasets
• Rotated every exposed credential, then rotated all internal credentials as a precaution
• Rebuilt the VS Code extension marketplace after authenticity review
• Expanded network restrictions on service providers so stolen credentials cannot run outside intended locations
• Added secret scanning across repositories and internal data sources
• Redeployed production infrastructure as a precaution
• Engaged external forensics

For the Fireworks-side timeline (Unit 42, LLMjacking, Uber driver notices), see Fireworks AI October breach update and Notion claims vs verified.

Timeline table

Update (November 14, 2026): Trade press and backdoor effectiveness limits

On November 14, BleepingComputer published a walkthrough of Cursor’s November 13 forensic update, adding no new scope numbers beyond Cursor’s own post. Its useful addition for defenders is attribution to security researchers who note implementation bugs in the tampered VSIX: the loader often could not turn on local SSH on macOS and Windows without admin rights that a VS Code extension typically lacks, so the svc-telemetry tunnel path may have failed to yield remote login on many laptops.

That limit does not shrink the incident. Cursor and Phorion’s reverse-engineering write-up still describe authorized_keys planting, persistence scripts, and host beacons that survive extension uninstall. If Remote Login was already enabled, or an admin enables it later, a planted key remains dangerous. Continue svc-telemetry checks, Cursor’s remediation scripts, and credential rotation when notified. Mechanism detail lives in our Claude Code 2.1.313 extension post.

BleepingComputer also situates the breach inside Wiz’s Black October label for October’s AI-developer credential thefts — the same industry pattern we summarized in Black October: nine AI developer platforms.

What this means if you run AI coding agents

Privacy Mode and telemetry sharing

Cursor’s disclosure is a concrete reason to default Privacy Mode on for repositories with secrets, customer data, or privileged legal matter text. The exposed bucket held traces Cursor was allowed to use for training — the same class of vendor-side retention Notion disputed with Fireworks when Insights transcripts appeared in the breach.

Before you rely on any IDE’s “we don’t store prompts” marketing line, map which subprocessors receive historical traces, not only live API calls.

Check the extension, not only the agent

The malware landed in the IDE extension supply chain, not in Claude Code’s official npm channel. If you use Cursor’s marketplace rather than Open VSX or Anthropic’s distribution:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, Cursor publishes a PowerShell one-liner in its security notice. Uninstalling the extension is insufficient — remove persistence and rotate credentials from a trusted machine.

Rotate with scope discipline

Cursor emailed team admins with specific keys where API credentials appeared in traces. If you did not receive mail, Cursor says you were not in the less than 0.01% credential-exposure bucket for traces — but still run the extension check if you updated on October 29.

Broader rotation triggers that transfer to any agent harness:

1. Provider keys in environment variables or agent config files the IDE can read (Northflank and Railway showed the same hunt-for-AI-key-names pattern in October).
2. Vendor keys you issued to inference partners — if your team fine-tunes or shares eval JSONL with Fireworks-like vendors, assume bucket + key compromise = trace leak until the vendor clears your tenant.
3. SSH and cloud keys on hosts that ran the tampered VSIX.

Trust boundaries in the IDE stack

This incident combines third-party inference risk with marketplace cache risk. It sits beside Cursor MCP config poisoning (local config trust) and Embrace’s embedded-browser flaws (page-to-agent bridging). None of those CVEs explain October’s extension swap, but together they argue for local observability on what the agent can read and execute after the IDE loads untrusted artifacts.

Compare default approval posture across tools in Cursor, Claude Code, and Copilot safety comparison.

What Beam can and cannot do here

Beam is local-first: it watches Claude Code, Codex, and similar agents on your machine, scans skills and MCP configs with eleven heuristic patterns plus an MCP version-pin check, and can deny risky PreToolUse actions on supported harnesses when workspace policy is in enforce mode. It redacts recognized credential formats before events persist locally.

For this incident specifically:

• Can help: surface when an agent reads .env files, prints tokens, or runs destructive shell commands while you investigate a potentially compromised host; flag suspicious MCP or skill files if the attacker left repo-side persistence (Beam does not replace endpoint antivirus or SSH forensics).
• Cannot help: detect Cursor cloud bucket access, marketplace cache tampering, or Fireworks-side key exposure; Beam does not see vendor SaaS logs; missing cached policy is fail-open, not a sandbox.

Pair Beam’s workspace watches with vendor email and Cursor’s IOC list — not instead of them.

Related reading

• Claude Code VS Code extension 2.1.313 compromised: SSH backdoor — payload mechanics and cleanup order
• Fireworks AI October breach: billing, weights, LLMjacking — vendor bulletin and Uber driver-notice context
• Black October: nine AI developer platforms — industry-wide credential hunting
• Notion and Fireworks: claims vs verified — another agent-vendor trace exposure
• November 2026 attacks timeline — month-wide incident context

Primary sources: Cursor forensic update (Nov 13, 2026) · Cursor Claude Code security notice · Fireworks November 9 bulletin

Frequently asked questions

What did Cursor publish on November 13, 2026?

Cursor posted a forensic update tying its October incident to a Fireworks-exposed vendor access key, unauthorized copies of historical coding-agent traces, pivoting through Cursor SaaS with stolen credentials, and tampered Anthropic.claude-code 2.1.312 and 2.1.313 builds on the VS Code extension marketplace cache for about 11 hours on October 29.

How many Cursor users were affected?

Cursor says fewer than 0.05% of users not on Privacy Mode had coding-agent traces in the exposed bucket, less than 0.01% had API credentials in those traces, and at most 5,000 users who requested specific cached extension versions on October 29 may have received the malicious Claude Code build. It contacted affected customers directly.

Does Privacy Mode protect my prompts and code?

Yes, per Cursor: prompts and code for users on Privacy Mode were not in the exposed historical traces. The breach concerned offline storage shared with a training vendor, not live traffic to Cursor at the time of the update.

Is Anthropic's Claude Code product vulnerable?

Cursor states Anthropic did not publish the malicious copies, Anthropic's product was not vulnerable, and Open VSX never carried the tampered builds. The malware appeared only on Cursor's marketplace cache.

How do I check for the malicious Claude Code extension?

On macOS run grep -qs svc-telemetry ~/.ssh/authorized_keys. On Windows check authorized_keys paths for svc-telemetry. If you installed Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace on October 29, follow Cursor's remediation scripts and IOCs at its security notice; uninstalling alone is not enough.

What should I rotate after this incident?

If Cursor emailed you about exposed API credentials, rotate those keys with the issuing providers. If you installed the tampered extension, rotate credentials reachable from that host from a clean system. Anyone sharing agent traces with inference vendors should rotate vendor-issued keys and review whether historical telemetry contained secrets.

Cursor and Fireworks statements reflect vendor pages as of November 14, 2026.