An update on our recent security incident
Cursor detailed a security incident that began when an attacker obtained an access key Cursor had issued to Fireworks, which Fireworks exposed, and used it to copy limited coding agent traces from a read-only storage bucket, with under 0.01% of customers having API credentials exposed. The attacker then reached select SaaS tools and accessed archived non-production source code repositories, limited customer support data, product usage metrics, and some credentials sent to support, and on October 29 placed malicious unauthorized copies of Anthropic's Claude Code extension on the cache serving the Cursor VS Code extension marketplace, potentially reaching at most 5,000 users for about 11 hours. Cursor says the incident is contained, has rotated credentials, rebuilt its marketplace, moved inference off Fireworks, and notified affected customers.
Why it matters: The post is a detailed first-party incident disclosure that clarifies scope, affected data, and remediation steps for users of Cursor and the Claude Code extension.