Cursor traces October breach to Fireworks AI key and backdoored extensions
Original title: Cursor Reveals How a Leaked Fireworks AI Key Led to a Backdoored Claude Code Extension
A read-only vendor key exposed agent traces and credentials; malicious Claude Code builds sat in Cursor’s cache for about 11 hours.
Cursor’s November 13 update says an access key it issued to Fireworks AI gave read-only access to a shared bucket of coding-agent traces, mostly from 2025 and outside Privacy Mode. Credentials in those records let the attacker reach selected Cursor services and, on October 29, place modified Claude Code packages in the marketplace cache. Cursor says Anthropic did not publish them, Open VSX never hosted them, and the last observed attacker activity on November 1 was blocked.
Unconfirmed: The 5,000 figure is potential distribution, not confirmed backdoor connections, and containment is Cursor’s assessment.
- Fewer than 0.05% of users had traces exposed; under 0.01% had API credentials exposed.
- At most 5,000 users may have received malicious builds, not confirmed infections.
- Affected packages were Anthropic.claude-code 2.1.312 and 2.1.313 on Windows and macOS.
- The extension added an SSH key named svc-telemetry and tried a reverse SSH tunnel.
- Notion and Uber disclosed separate Fireworks-related impacts, not this extension attack.
Impact: Agent traces, credentials, and support data exposed; backdoored extensions cached
| Product | Affected |
|---|---|
| Anthropic Claude Code | 2.1.312 and 2.1.313 for Windows and macOS |
- 1.Follow Cursor’s cleanup notice; removing the extension may leave SSH keys and startup scripts.
- 2.Isolate affected machines, remove persistence, and check endpoint evidence.
- 3.Rotate accessible credentials from a trusted system and assess whether a rebuild is needed.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1098.004 SSH Authorized KeysT1572 Protocol TunnelingT1543.001 Launch AgentT1053.005 Scheduled Task
- Vendors
- CursorFireworks AIAnthropic
- Products
- Claude Code
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 134.209.82.225 | beled svc-telemetry , and attempted a reverse SSH tunnel to 134[.]209[.]82[.]225 . The initial data upload included environment variab |
From the original article
3 min read at cybersecuritynews.com
Cursor has traced its October security breach to an access key exposed by Fireworks AI. The attacker used that key to steal historical coding agent records, find more credentials, and eventually place backdoored Claude Code extensions in Cursor’s marketplace cache. Its November 13 update connects the vendor exposure to the malicious packages discovered on October […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.