Cursor investigates security incident: malicious extension affects up to 5,000 people
Understand this story
Cursor has published the findings of its investigation into the October 29 security incident: attackers used access keys leaked by Fireworks to enter its systems and placed a malicious copy of the Anthropic Claude Code extension in Cursor's VS Code extension marketplace cache. Cursor said that up to 5,000 users who requested a specific cached version of the extension on October 29 may have received the malicious version, which existed for about 11 hours before being removed. Cursor said that fewer than 0.01% of customers' API credentials were leaked; among users who had not enabled Privacy Mode, fewer than 0.05% had coding agent traces exposed. The above percentages and user counts are Cursor's own reported investigation findings.
AI overview based on source reports · Updated 12 hr ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Cursor BlogFeaturedAn update on our recent security incident
Cursor detailed a security incident that began when an attacker obtained an access key Cursor had issued to Fireworks, which Fireworks exposed, and used it to copy limited coding agent traces from a read-only storage bucket, with under 0.01% of customers having API credentials exposed. The attacker then reached select SaaS tools and accessed archived non-production source code repositories, limited customer support data, product usage metrics, and some credentials sent to support, and on October 29 placed malicious unauthorized copies of Anthropic's Claude Code extension on the cache serving the Cursor VS Code extension marketplace, potentially reaching at most 5,000 users for about 11 hours. Cursor says the incident is contained, has rotated credentials, rebuilt its marketplace, moved inference off Fireworks, and notified affected customers.
Activity for this story
- Current comparable activity
- 5
- Peak comparable activity
- 7Nov 14 10:00
- Change in the past 24 hours
- –
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.