The breach also let attackers access internal systems and steal customer data, including historical AI coding-agent traces containing unredacted credentials that were later used to compromise extra services. The breach was disclosed in a new incident report published Friday, which explains how attackers distributed malicious versions of Anthropic's Claude Code extension through Cursor's marketplace on October 29. The attack exposed up to 5,000 developers to malware that installed persistent SSH backdoors.
Cursor is an AI-powered code editor built on Microsoft's open-source Visual Studio Code (VS Code), allowing developers to write, modify, and debug software using AI assistants. According to Cursor, the attack began when hackers obtained an access key stored on Fireworks AI, a third-party provider used for AI model training and inference. The attackers used the exposed key to copy data from a read-only storage bucket Cursor used to share information with Fireworks. This bucket contained historical AI coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode and whose data could be used for model training.
