San Francisco-based coding assistant maker Cursor confirmed that attackers compromised its marketplace cache to distribute backdoored copies of Anthropic’s Claude Code extension on October 29, 2026. The incident started after an access key issued to AI vendor Fireworks AI leaked, giving intruders access to older coding session logs and unredacted credentials. Intruders then pivoted through support and business tools before uploading altered packages that reached up to 5,000 developers. The disclosure of the Cursor breach reveals how third-party AI pipelines can feed supply-chain attacks against development tools [1].
How the Cursor Breach Began at Fireworks
The intrusion started outside Cursor’s own network at Fireworks AI, an outside vendor used for model training and inference. An access key that Cursor had given to Fireworks was exposed, letting an attacker copy data from a read-only storage bucket shared between the two firms. Fireworks exposed the key. That bucket held older coding-agent traces, mostly from 2025 sessions where developers had not turned on Privacy Mode [2].
Cursor said the exposure affected a tiny fraction of its total user base, with fewer than 0.05% of users having session logs exposed and fewer than 0.01% of customers losing API credentials. But some older logs still carried active tokens that had never been scrubbed before export. The read-only bucket used for offline analysis lacked automated secret redaction, leaving sensitive developer keys vulnerable in stored traces. Sessions where users turned on Privacy Mode remained isolated from these shared datasets [7].
With those unredacted keys, the intruder reached several SaaS tools used by Cursor for daily business tasks. The attacker accessed archived source code repositories that were not used in production, limited customer support email threads, product usage numbers, summaries of coding chats, and credentials that users had sent to support staff [1].
Malicious Extension Uploaded to Marketplace Cache
Armed with a login credential stolen from Cursor’s SaaS systems, the intruder targeted the Cursor VS Code extension marketplace on October 29, 2026. The attacker uploaded altered versions of Anthropic’s Claude Code extension, designated versions 2.1.312 and 2.1.313, straight into the cache serving the marketplace. “On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic’s Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace,” Cursor explained [2].
Anthropic did not build or publish the tampered files, and the Open VSX registry behind the store never held the malicious code. Open VSX remained clean. The exposure window ran between 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, leaving the modified packages live in the cache for roughly 11 hours before Cursor took the marketplace offline. Up to 5,000 developers who installed or updated the extension during that window received the infected build on Windows and macOS computers [3].
Developer marketplaces face growing supply-chain threats, contrasting with web server compromises where hackers exploit a critical WordPress flaw for code execution to breach hosts. The incident also mirrors risks documented in Chrome search hijacking across malicious extensions where rogue add-ons abuse store distribution to reach user machines.
Mechanics of the Malicious SSH Backdoor
Security researchers who examined the altered Claude Code packages found that attackers inserted a malicious 66-line loader into extension.js right before the genuine extension code. Security researcher Paul McCarty said on OpenSource Malware that this setup executed whenever the extension started up, meaning developers did not even need to send a prompt to Claude to trigger the script. The loader also suppressed error reporting to hide its presence during execution. macOS security firm Phorion pointed out that because extensions run with the privileges of the editor, the payload could inspect files and developer tooling as soon as it loaded. When developer tools execute third-party scripts without sandboxing, rogue extensions gain the same file system access as the host user [4].
The loader gathered system details, including hostnames, usernames, CPU architectures, home directories, Git commit emails, and public IP addresses (checked via ifconfig.me and api.ipify.org). It also scanned up to 40 environment variable names looking for words such as AWS, GCP, KEY, TOKEN, SECRET, or PASS. After finishing this reconnaissance, the script attempted to append an attacker-controlled public SSH key labeled svc-telemetry to the user’s authorized_keys file and establish a reverse SSH tunnel to remote IP address 134.209.82.225 [5].
For persistence, the malware dropped a LaunchAgent named com.apple.sysmond.plist on macOS and registered a scheduled task named SysMon on Windows. Background scripts were set to retry the reverse SSH tunnel roughly every 60 seconds. The backdoor usually failed. Turning on the local SSH service needed root or administrator rights, which Cursor did not possess on standard developer laptops unless explicitly run with elevated permissions. Why did the attack fall short on most systems? Default operating system boundaries prevented the unprivileged script from enabling system services [4].
Containment Steps After the Cursor Breach
Cursor’s automated monitoring systems detected unauthorized activity, prompting the engineering team to cut off the Fireworks access key and launch an incident response workstream. The company took down its extension marketplace, contacted the cloud provider hosting the attacker server at 134.209.82.225 to disable the endpoint, and blocked the last detected intruder activity on November 1, 2026 [2].
To clean up affected machines, Cursor published cleanup scripts named remediate-macos.sh and remediate-windows.ps1. The company warned that simply uninstalling the extension isn’t enough because the installer dropped standalone persistence files that keep running in background folders. British cybersecurity researcher Kevin Beaumont noted on Mastodon that Anthropic’s clean update to version 2.1.314 didn’t remove existing backdoors, so developers must verify their authorized_keys files by hand [4].
Following containment of the Cursor breach, the company cut all inference traffic from Fireworks AI and rotated every exposed credential across internal systems. Cursor also rebuilt its extension marketplace from scratch, redeployed its production infrastructure, and added secret scanning across code repositories to stop unredacted keys from reaching training datasets. External forensics experts were brought in to verify that core production systems, customer Git repositories, and release signing keys remained untouched [7].
Wider Wave of AI Infrastructure Attacks
The incident occurred amid what cybersecurity firm Wiz named Black October, a series of coordinated attacks targeting AI developer platforms and GPU cloud providers. Intruders have targeted development systems to steal API secrets, hijack compute for model training, or perform unauthorized model distillation. Attackers targeted development systems. Other platforms hit during the same wave include Railway, Northflank, Lightning AI, OpenCode, and Warp [1].
Financial losses across affected developer services climbed quickly, with Railway reporting that attackers used stolen authentication secrets to run up about $740,000 in fraudulent AI inference charges. Fireworks AI disclosed multiple security incidents throughout October, which also affected other customers like Notion, where chat transcripts from a small number of workspaces were exposed. The targeting of shared infrastructure shows that third-party AI suppliers now represent a focal point for credential theft [1].
Anthropic spokesperson Felix Rieseberg confirmed that the company’s internal networks remained untouched and stated that the compromise existed solely within Cursor’s cached distribution layer. Version 2.1.314 replaced it. The episode shows how third-party data pipelines and training caches can turn into footholds for supply-chain attacks against modern developer environments [6].
- ONLINE NEWS Abrams, L. (2026, November 14). Cursor confirms security breach led to malicious Claude Code extension. BleepingComputer. [Article Link]
- WEBSITE Cursor Team. (2026, November 13). An update on our recent security incident. Cursor Blog. [Article Link]
- ONLINE NEWS WebUtility News Desk. (2026, November 14). Cursor Breach Spread a Fake Claude Code Extension to Up to 5,000 Users. WebUtility.io. [Article Link]
- ONLINE NEWS Wang, T. (2026, November 13). Cursor Confirms Anthropic Claude Code Extension Compromised. BankInfoSecurity. [Article Link]
- WEBSITE Cursor Team. (2026, October 29). Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace. Cursor Blog. [Article Link]
- ONLINE NEWS Dufresne, A. (2026, November 14). Cursor confirms Fireworks leak enabled malicious Claude Code. AI Weekly. [Article Link]
- WEBSITE Thakker, Y. (2026, November 14). Cursor: Fireworks Key Led to Claude Code Malware. Explainx.ai Blog. [Article Link]
