Cursor Security Incident Update: Majority of Users Unaffected

Huo Xing Cai Jing reports that Cursor has released an update on the recent security incident. After two weeks of a comprehensive investigation, it was determined that the breach originated when an attacker obtained an access key issued by Cursor to Fireworks. This key was leaked by Fireworks, allowing the attacker to replicate limited trace data from programming agent chains and further compromise certain SaaS tools, gaining access to some archived source code and support data. Subsequently, the attacker used the stolen credentials to distribute a malicious copy of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) in the Cursor VS Code extension marketplace cache on October 29. Up to approximately 5,000 users may have been affected; the malicious version was removed after about 11 hours. Cursor emphasized that the vast majority of customers were not impacted, and affected customers have been notified directly. Data for users in privacy mode remains secure; production systems, official application updates, and customer code repositories were not compromised. The company has rotated credentials, migrated inference traffic, and rebuilt the extension marketplace, and believes the incident was contained as of November 1.