Cursor disclosed on November 13 that an attacker used a vendor key exposed by Fireworks AI. The key let the attacker copy historical coding-agent traces. Some of those traces contained unredacted credentials. The attacker used them to reach internal tools. They then planted malicious copies of the Claude Code extension in the marketplace.
The vendor key opened a bucket of traces
Cursor reported that the attacker obtained an access key Cursor had issued to Fireworks. Fireworks is the AI training and inference provider. The key gave read access to a storage bucket. That bucket held coding-agent traces, mostly from 2025, from sessions not in Privacy Mode. The traces were eligible for model training.
Some traces held credentials that had not been redacted. BleepingComputer reports that fewer than 0.01 percent of customers had API credentials exposed. The attacker used those credentials to pivot into Cursor SaaS tools.
The credentials opened internal tools and the extension cache
The attacker reached select SaaS tools. From those tools they accessed archived source code, support data and product metrics. They also pulled summaries of some coding-agent conversations. On October 29, they used a stolen credential. It let them place malicious builds of the Claude Code extension. The builds went into the cache serving the marketplace. Cursor says up to 5,000 users could have received versions 2.1.312 or 2.1.313. The window lasted eleven hours.
Security researchers found the malicious extension tried to add an attacker SSH key to authorized_keys. It also tried to enable the local SSH service and open a reverse tunnel. The extension also installed persistence and reported host details to a command server. Cursor noted that coding errors likely prevented the backdoor from working on most systems. The extension lacked the admin rights needed to enable SSH.
Cursor moved all inference traffic off Fireworks and rotated every exposed credential. It then rotated all internal credentials as a precaution. The company considered the incident contained as of November 1. That was when the last attacker activity was blocked.
Logs I would check
Atelier has an agent that asks for approval before it sends, posts or drafts email. I would check whether the agent's approval requests are logged. I would also check whether those logs hold credentials or tokens the agent showed me. The optional thread sync to R2 is another place I would look. I would check whether it ever writes a credential that appeared in a conversation.
AI Trader records every decision with its inputs, output and cost. I would check whether any decision log includes an API key. I would also look for a brokerage token in full. If I logged the agent's reasoning, I would check whether the reasoning ever repeated a credential. It could pull one from an earlier step.
The Coen ERP has a mandatory human review gate. I would check whether approval-request logs ever hold an ADP credential. I would also check for a Stripe key that the agent quoted from a prior run.
The training history kept the keys.
Somewhere a coding agent just pasted a database password into a trace file marked for training. You know whose cleanup that is.