Cursor breach began with an exposed Fireworks key

In an incident update published on November 13, 2026, Cursor explained the starting point of the data breach. According to the company, an attacker used an access key issued in Cursor’s name that had been exposed on the Fireworks AI side to copy historical coding agent traces and the credentials left in those traces. At the end of the chain, malicious AI coding assistant builds were placed in Cursor’s VS Code extension marketplace.

The key accessed a read-only bucket

The key exposed by Fireworks made it possible to copy data from a read-only storage area that Cursor used to share data with the provider. The contents there consisted mostly of limited coding agent traces, most of them from 2025, and belonged only to sessions with Privacy Mode turned off. Cursor was entitled to use this data for model training.

A small portion of the traces contained unmasked credentials. Using those credentials, the attacker logged into some of the cloud software tools Cursor used. From there, they reached archived and non-production source code repositories; some of those repositories contained business contact information. Other material accessed included limited support data, email correspondence, product usage metrics, contact information, summaries of some coding agent conversations, and credentials users had sent to the support team.

Live traffic and customer code were not affected

According to Cursor’s statement, API credentials were exposed for fewer than one in a thousand customers. Among users who did not use Privacy Mode, agent traces were involved for less than 0.05 percent, and the company directly notified every affected user.

Current customer data, live traffic, active inference requests, and prompts and code in Privacy Mode were not affected. There was also no impact on the production systems running the service or on customer code repositories. Official app updates are safe: the release code is kept in a separate hosting system, the attacker never reached it, and the release signing keys were not exposed.

The infection in the extension marketplace

The update also ties the malicious extension incident announced on October 29, 2026 to this chain. Using a credential stolen from the exposed internal data, the attacker placed unauthorized builds into the cache serving Cursor’s VS Code extension marketplace. Anthropic did not publish these builds, and no vulnerability was created in its own product; the malware never reached the Open VSX source.

Cursor estimates that at most 5,000 users who requested specific cached versions may have received the malicious build during a window lasting about 11 hours. On October 30, the company published indicators of compromise and remediation steps, and notified affected users and team admins through in-app messages and email. Admins were given a list of keys that needed to be rotated, and revocation was requested from the third-party services that had issued those keys.

Measures taken by Cursor

All inference traffic was moved off Fireworks, the provider key was disabled, and Fireworks’ access to shared datasets was cut off. All exposed Cursor credentials were rotated; then, even without evidence, all credentials used in internal systems were renewed as a precaution. The company expanded network restrictions, added secret scanning to code repositories and other internal data sources, rebuilt the production infrastructure, and began working with external digital forensics experts.

Cursor says the last attacker activity was seen and blocked on November 1, 2026. The incident is considered contained, and monitoring for unusual activity is continuing. On the Fireworks side, meanwhile, an incident occurred on October 23, 2026 at a third-party cloud provider hosting research and development machines. According to the company’s bulletin, an unauthorized party reached development machines on October 24 and ran an unauthorized workload that led to additional customer data impact. Fireworks detected the activity that day and has not seen any new unauthorized access on the customer platform since October 25; the findings may change as the investigation continues.

The company rotated credentials and service accounts, removed unnecessary elevated privileges, restricted network paths, and tightened storage and analytics access controls. With support from Palo Alto Networks Unit 42, it strengthened logging and monitoring. During the investigation, it disabled self-service upload and download used for Batch Inference and dataset-based training.

Source: Unite.AI