Stolen Fireworks AI credentials used to push a malicious Claude Code extension on Cursor (2026)

On 13 November 2026, Cursor — the San Francisco company behind the AI-assisted code editor of the same name — confirmed that attackers had used credentials stolen from its AI model provider Fireworks AI to breach its systems and briefly distribute a tampered version of Anthropic's Claude Code extension through Cursor's own VS Code extension marketplace. The incident is part of a wider wave of attacks on AI developer platforms that researchers have dubbed "Black October," in which multiple Fireworks AI breaches cascaded into downstream customers.

How the attack unfolded

Attackers first obtained an access key stored at Fireworks AI and used it to copy data from a read-only storage bucket Cursor used to share information with the provider. That bucket held historical AI coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode; some of those traces contained unredacted API credentials, which gave the attackers access to additional Cursor systems. On 29 October, they used a stolen credential to place unauthorised copies of the extension — versions 2.1.312 and 2.1.313 — directly in the cache serving the Cursor marketplace, where they were available for roughly 11 hours before removal. Anthropic's legitimate extension and the Open VSX registry were not compromised.

What the malware did

The modified extension ran JavaScript that collected system information, installed an attacker-controlled SSH key, attempted to enable SSH and set up persistence. Security researchers noted coding errors that likely prevented the backdoor from functioning on many Windows and macOS systems where SSH was not already enabled. Cursor said up to 5,000 users who requested the affected versions during the exposure window may have received a malicious build. Separately, fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% had API credentials compromised; archived non-production source code, limited support data and some AI conversation summaries were also taken.

Response and why it matters

Cursor's monitoring detected the unauthorised activity; the company revoked the Fireworks access key, rotated exposed credentials, temporarily shut down some services, moved all inference traffic away from Fireworks, rebuilt its extension marketplace and redeployed its production infrastructure. Cursor said production infrastructure, official application releases, customer code repositories and Privacy Mode data were not affected. The episode is a sharp reminder that a developer tool's extension-distribution channel is itself a supply-chain target: a single leaked vendor key let attackers reach thousands of developer machines through software they already trusted.