Cursor Says Most Users Were Unaffected by Security Incident; Affected Users Notified

According to ChainCatcher, Cursor said a two-week investigation found that an attacker obtained an access key it had issued to Fireworks, which was exposed by Fireworks. The attacker copied a limited amount of coding-agent trace data and used it to access some archived source code and support data through SaaS tools. On October 29, the attacker used stolen credentials to place malicious copies of the Anthropic Claude Code extension, versions 2.1.312 and 2.1.313, in the Cursor VS Code extension marketplace distribution cache. Up to about 5,000 users may have been affected; the versions were removed after about 11 hours. Cursor said most customers were unaffected and affected users had been notified directly. Data from users in Privacy Mode, production systems, official app updates, and customer code repositories were not affected. Cursor said it rotated credentials, moved inference traffic, and rebuilt the extension marketplace. The company said it brought the incident under control on November 1.