Sự cố bảo mật của Cursor: Phần lớn người dùng không bị ảnh hưởng

The Huoxing Finance report states that Cursor has released an update on the recent security incident. After two weeks of a comprehensive investigation, it was determined that the breach originated from an access key issued by Cursor to Fireworks, which was subsequently leaked by Fireworks. This allowed the attacker to replicate limited programming agent chain-tracing data and further compromise certain SaaS tools, gaining access to some archived source code and support data. The attacker then used the stolen credentials to distribute a malicious copy of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) in the Cursor VS Code extension marketplace cache on October 29. Up to approximately 5,000 users may have been affected; the malicious version was removed after about 11 hours. Cursor emphasized that the vast majority of customers were unaffected, and affected customers have been directly notified. Data for users in privacy mode remains secure, and production systems, official application updates, and customer code repositories were not compromised. The company has rotated credentials, migrated inference traffic, and rebuilt the extension marketplace, and believes the incident was contained as of November 1.