Cursor confirms Fireworks leak enabled malicious Claude Code

Cursor said attackers used a credential stolen from AI infrastructure provider Fireworks AI to upload two malicious copies of Anthropic's Claude Code extension to its marketplace, where the trojanized builds sat live for roughly 11 hours and may have reached up to 5,000 developers, BleepingComputer reported.

The affected versions were 2.1.312 and 2.1.313, both pushed on October 29. Cursor's incident report, as quoted in the article, says: "On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace."

Once installed, the modified extension "collected system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and configured persistence mechanisms to maintain remote access," per BleepingComputer. Coding errors in the malware likely prevented the backdoor from functioning on many Windows and macOS systems that didn't have SSH enabled by default.

The reported customer-data exposure is narrow as described: fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% had API credentials compromised. The historical traces pulled from Cursor's read-only bucket at Fireworks also included unredacted API credentials, archived source-code repositories, customer support conversations, and product usage metrics. Cursor has rotated the exposed credentials, rebuilt its extension marketplace, redeployed production infrastructure, and moved inference traffic off Fireworks. The article carries no statement from Fireworks AI.

The extension-marketplace-as-attack-surface wrinkle is the newer piece of the story; our cybersecurity feed has carried 196 AI-security items over the last 90 days, and the Cursor writeup now sits among them.