Cursor’s November 13 investigation update traces its October incident to a key exposed at Fireworks. It opened a read-only bucket holding historical coding-agent traces, mostly from 2025 sessions outside Privacy Mode. Credentials left in those records enabled further access.
The attacker subsequently placed tampered Claude Code extensions in Cursor’s delivery cache on October 29. Up to 5,000 users potentially received the malicious builds during an approximately 11-hour window. This is a distribution estimate, not a count of confirmed compromised machines. Cursor says Anthropic did not publish the builds and Open VSX never hosted them.
Users who installed Anthropic.claude-code versions 2.1.312 or 2.1.313 during that window should follow Cursor’s remediation notice: check indicators, isolate affected hosts, remove persistence and rotate accessible credentials from a trusted system. Uninstalling the extension alone may leave malicious components behind.
Cursor says it revoked credentials, rebuilt the marketplace and moved inference away from Fireworks.
