Cursor confirms security breach led to malicious Claude Code extension

Cursor has confirmed a data breach exposing 5,000 users.

Cursor confirmed it suffered a security breach that let hackers distribute a malicious Claude Code extension through its marketplace after stealing credentials from AI infrastructure provider Fireworks AI.

The breach also let attackers access internal systems and steal customer data, including historical AI coding-agent traces containing unredacted credentials that were later used to compromise further services.

The breach was disclosed in a new incident report published Friday, which explains how attackers distributed malicious versions of Anthropic's Claude Code extension through Cursor's marketplace on October 29.

As BleepingComputer previously reported, the attackers modified the legitimate Claude Code extension to execute malicious JavaScript that attempted to install persistent SSH backdoors on developers' computers.

However, security researchers found coding errors that likely prevented the backdoor from working on many Windows and macOS systems where SSH was not already enabled.

Anyone whose data Cursor held is potentially affected by this breach.

This bucket contained historical AI coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode and whose data could be used for model training.

Some of these traces contained unredacted API credentials, allowing the attackers to access more Cursor systems.

Beyond the immediate exposure, Cursor now has to rebuild trust with everyone whose data it held.

The attack exposed up to 5,000 developers to malware that installed persistent SSH backdoors.

Cursor is an AI-powered code editor built on Microsoft's open-source Visual Studio Code (VS Code), allowing developers to write, modify, and debug software using AI assistants.

The access point here was stolen login credentials, not a technical vulnerability.

Cursor says fewer than 0.05% of users had coding-agent traces exposed, while fewer than 0.01% of customers had API credentials compromised.

Using the exposed credentials, the hackers stole data from several of Cursor's software-as-a-service (SaaS) tools, including: Cursor says its monitoring systems detected the unauthorized activity, leading the company to revoke the Fireworks access key, rotate exposed credentials, and investigate more unauthorized access.

As the investigation progressed, Cursor temporarily turned off some internal and product services as a precaution.

The company says its production infrastructure, official application releases, customer code repositories, and code and prompts belonging to users with Privacy Mode enabled were not affected.

Cursor says it has moved all inference traffic away from Fireworks, revoked and rotated exposed credentials, rebuilt its extension marketplace, and redeployed its production infrastructure as a precaution.

If you have any relationship with Cursor, watch for phishing attempts that reference this breach specifically -- stolen data often gets reused this way.

Any unsolicited message referencing this breach is worth treating with suspicion, since attackers commonly impersonate the breached company afterward.

Customers who installed or updated to the affected Claude Code extension during the attack are advised to follow Cursor's remediation guidance.