Cursor Blames Breach Chain on Access Key Exposed by Fireworks AI

A vendor-exposed access key let an attacker copy historical coding-agent traces and credentials from Cursor, then push malicious Claude Code extension builds to at most 5,000 users. That's the core finding of an incident update Cursor published on November 13, 2026, which for the first time connects the extension marketplace compromise to a chain that began with a key issued to Fireworks AI.

Here's how the chain worked. Fireworks' exposure of the Cursor-issued key allowed data to be copied from a read-only bucket Cursor used for data sharing with the vendor. The bucket held limited coding-agent traces, mostly from 2025, from sessions that weren't using Privacy Mode — data Cursor was permitted to use for model training. A small number of those traces contained unredacted credentials, which gave the attacker a route into select software-as-a-service tools used by Cursor.

Less than 0.01% of customers had API credentials exposed. Among users not using Privacy Mode, coding-agent traces were exposed for fewer than 0.05%, and Cursor says it identified and notified each affected user directly.

What did the attacker actually reach?

From the compromised SaaS tools, the attacker accessed select archived, non-production Cursor source repositories, some containing business contact information. Other exposed material included:

• Limited support data and email conversations
• Product-usage metrics and contact details
• Summaries of some coding-agent conversations
• Credentials users had sent to Cursor's support team

The blast radius stops there, according to Cursor. Current customer data and live traffic, active inference requests, and Privacy Mode prompts and code were not affected. Production systems and infrastructure that run the service were untouched, as were customer code repositories. Official app updates and shipped code sat in a separate hosting system the attacker never accessed, and no release-signing keys were exposed. Cursor validated all other extensions in its VS Code marketplace and reviewed and rebuilt the store.

How the marketplace compromise fits in

The November 13 update ties the intrusion to Cursor's earlier malicious Claude Code extension disclosure. On October 29, 2026, the attacker used a credential stolen from the exposed internal data to place unauthorized builds directly on the cache serving Cursor's VS Code extension marketplace. Anthropic did not publish them and its product was not vulnerable; Open VSX, the marketplace source, never carried the malware. Cursor estimates at most 5,000 users who requested specific cached versions potentially received a malicious build during roughly 11 hours of availability.

Cursor published indicators of compromise and remediation material on October 30, 2026, and began notifying affected users and team administrators through in-app messages and email. Administrators received lists of specific keys to rotate where credentials were exposed, and Cursor asked the issuing third-party services to revoke them. Customers whose support or business data may have been involved were notified directly.

Cursor's monitoring systems flagged the unauthorized activity. The company temporarily disabled more internal and product services than the evidence required — disrupting certain features — and restored each after review. Cursor believes the incident is contained: the last attacker activity it observed occurred on November 1, 2026, and was blocked. Monitoring for anomalous activity continues.

What does this change for practitioners?

Two things: vendor access and credential hygiene. Cursor moved all inference traffic off Fireworks, deactivated the vendor key, and cut off Fireworks' access to all datasets shared with it. Every exposed Cursor credential identified was rotated, followed by all credentials in use across internal systems as a precaution — even where there was no evidence of exposure. Cursor also expanded network restrictions across service providers where possible, added secret scanning to code repositories and other internal data sources, redeployed production infrastructure, and engaged external forensics experts.

For teams running coding agents, the lesson is concrete: credentials left in historical traces became the pivot point. The exposed traces came from storage used for historical offline analysis, from sessions that lacked Privacy Mode protection.

The Fireworks side of the story

Fireworks AI's own security bulletin reports a separate incident one layer down the stack. A third-party cloud provider hosting Fireworks' research-and-development machines experienced an incident on October 23, 2026. An unauthorized party reached Fireworks development machines on October 24, 2026, and ran an unauthorized workload that led to additional customer-data impact. Fireworks detected the activity that same day and has not detected further successful unauthorized access on the customer platform since October 25, 2026. Those findings remain subject to an ongoing investigation.

Fireworks revoked and replaced credentials and service accounts, removed unnecessary elevated privileges, restricted network pathways, tightened storage and analytics access controls, and enhanced logging and monitoring with assistance from Palo Alto Networks Unit 42. It disabled self-serve dataset uploads and downloads used by Batch Inference and dataset-based training during the investigation. The Training SDK remains available with zero data retention — no training data is stored at rest — while Lab-based training operates in an isolated environment.

Cursor's account puts the marketplace compromise at the end of a chain that started with a vendor key and ran through credentials left in historical traces. That makes vendor-access revocation and broad credential rotation central to Cursor's containment assessment — and Fireworks' still-open investigation means the vendor-side findings could yet change.