Cursor confirms Fireworks leak enabled malicious Claude Code
TL;DR
- The attacker pivoted from one leaked Fireworks API key to Cursor's marketplace write access through multi-hop lateral movement across vendor boundaries.
- The SSH backdoor survives extension uninstall via platform-specific persistence: LaunchAgents on macOS, cron on Linux, scheduled tasks on Windows.
- Cursor confirmed malicious builds never appeared on VS Code Marketplace, Open VSX, or the official npm package, containing blast radius to its own cache.
Cursor said attackers used a credential stolen from AI infrastructure provider Fireworks AI to upload two malicious copies of Anthropic's Claude Code extension to its marketplace, where the trojanized builds sat live for roughly 11 hours and may have reached up to 5,000 developers, BleepingComputer reported.
The affected versions were 2.1.312 and 2.1.313, both pushed on October 29. Cursor's incident report, as quoted in the article, says: "On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace."
Once installed, the modified extension "collected system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and configured persistence mechanisms to maintain remote access," per BleepingComputer. Coding errors in the malware likely prevented the backdoor from functioning on many Windows and macOS systems that didn't have SSH enabled by default.
The reported customer-data exposure is narrow as described: fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% had API credentials compromised. The historical traces pulled from Cursor's read-only bucket at Fireworks also included unredacted API credentials, archived source-code repositories, customer support conversations, and product usage metrics. Cursor has rotated the exposed credentials, rebuilt its extension marketplace, redeployed production infrastructure, and moved inference traffic off Fireworks. The article carries no statement from Fireworks AI.
The extension-marketplace-as-attack-surface wrinkle is the newer piece of the story; our cybersecurity feed has carried 196 AI-security items over the last 90 days, and the Cursor writeup now sits among them.
What others are reporting
-
Microsoft Security Blog Read →
Provides granular 5-step attack chain, platform-specific persistence mechanisms, SHA-256 hashes, and advanced hunting queries; clarifies that artifact presence alone does not confirm compromise.
The injected loader attempts to add an attacker-controlled SSH key, enable SSH service, establish reverse forwarding, and configure persistence.
-
SecurityWeek Read →
Reports the payload drops standalone persistence scripts that keep running even after extension uninstall, raising remediation stakes beyond standard removal.
A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension.
-
Cyber Security News Read →
Traces full attack chain from Fireworks credential exposure through lateral movement to marketplace compromise; debunks Open VSX claims; notes coding errors limited actual exploitation.
At most 5,000 users requesting specific cached versions potentially received malicious builds during roughly 11 hours.
-
ThreatDefence Read →
Provides platform-specific shell commands and KQL queries for Defender/Sentinel; traces the pivotal vector to unredacted credentials exposed in Fireworks coding-agent trace logs.
Tampered builds of the Claude Code extension were in the Cursor marketplace for about 11 hours on October 29, 2026.
-
Aviatrix Threat Research Center Read →
Maps the attack to NIST SP 800-53, PCI DSS 4.0, NIS2, DORA, and ISO 27001; prescribes defensive controls across the kill chain for compliance-bound organizations.
A hijacked VS Code marketplace extension gave attackers 11 hours to steal developer system data and plant persistent backdoors.
Originally reported by bleepingcomputer.com
Read the original article →Original headline: Cursor confirms Fireworks AI key leak let attackers ship backdoored Claude Code extension to ~5,000 developers