Cursor details full scope of security incident tied to Fireworks breach

Cursor, the AI coding tool made by Anysphere, published a detailed follow-up report on November 13, 2026, about a security incident first flagged on October 29. Cursor's update on the security incident says an attacker used an access key exposed in a separate Fireworks breach to read a bucket of coding-agent traces, and that malicious copies of the Claude Code VS Code extension sat on Cursor's Marketplace distribution cache for about 11 hours.

What the investigation found

• An attacker obtained an access key Cursor had issued to Fireworks, exposed through a separate Fireworks breach, giving read-only access to a bucket of coding agent traces, mostly from 2025, from sessions not in Privacy Mode.
• Fewer than 0.01% of customers had API credentials exposed through the traces, and fewer than 0.05% of non-Privacy-Mode users had traces exposed; affected users were notified directly.
• The attacker also accessed archived non-production source code repositories, customer support data, product usage metrics, and credentials sent to support.
• On October 29, the attacker placed malicious copies of the Claude Code extension, versions 2.1.312 and 2.1.313, on Cursor's VS Code Marketplace distribution cache.
• The malicious builds stayed live for about 11 hours before removal, and roughly 5,000 users potentially received them.
• Cursor's production application, official auto-updates, and client or cloud code-shipping systems were never accessed by the attacker.

What it means for builders using AI coding tools

Cursor is one of the most widely used AI coding tools, so this incident shows how a breach at a third-party model provider can cascade into exposed coding-agent data and a brief supply-chain compromise of an extension marketplace, a direct risk reminder for anyone running AI coding agents with real credentials.

Containment and next steps

Cursor said it migrated all inference traffic off Fireworks, rotated credentials, rebuilt the marketplace, redeployed production infrastructure, and engaged external forensics experts. The last confirmed attacker activity took place on November 1, 2026, and was blocked; Cursor considers the incident contained as of that date.

Sources

• An update on our recent security incident (Cursor (Anysphere), November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.