Cursor Updates Security Incident: Most Users Unaffected, 5,000 Possibly Impacted

ChainCatcher report: Cursor has released an update on the recent security incident. After two weeks of a comprehensive investigation, it was determined that the breach originated when an attacker obtained an access key issued by Cursor to Fireworks. This key was subsequently leaked by Fireworks, allowing the attacker to replicate limited tracing data for programming agents and further compromise certain SaaS tools, gaining access to archived source code, support data, and other information. The attacker then used the stolen credentials to distribute a malicious copy of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) in the Cursor VS Code extension marketplace cache on October 29. Up to approximately 5,000 users may have been affected; the malicious version was removed after about 11 hours. Cursor emphasized that the vast majority of customers were not impacted, and affected customers have been notified directly. Data for users in privacy mode remains secure; production systems, official application updates, and customer code repositories were not compromised. The company has rotated credentials, migrated inference traffic, and rebuilt the extension marketplace, and believes the incident was contained as of November 1.