{"slug": "cursor-links-fireworks-breach-to-agent-traces-and-marketplace-malware", "title": "Cursor Links Fireworks Breach to Agent Traces and Marketplace Malware", "summary": "Cursor published a November 13, 2026 account of its October security incident, stating that an attacker used a Cursor-issued access key exposed by Fireworks AI to copy historical coding-agent traces, pivot into Cursor SaaS tools, and on October 29 plant unauthorized builds of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) in the marketplace cache serving Cursor's VS Code extension store. Cursor said the malicious builds reached up to 5,000 users who requested those versions over roughly 11 hours on October 29, that unredacted API credentials appeared in traces affecting under 0.01% of customers, and that it cut off the key, moved inference off Fireworks, and blocked last attacker activity on November 1. The copied traces were mostly from 2025 and came from sessions not in Privacy Mode, which Cursor said it was permitted to use for model training.", "body_md": "**Cursor on November 13, 2026 published the fullest account yet of its October security incident**, naming [Fireworks AI](https://fireworks.ai/?ref=explainx) as the place the chain started. In [An update on our recent security incident](https://cursor.com/blog/security-incident-update?ref=explainx), Cursor says an attacker used a **Cursor-issued access key exposed by Fireworks** to copy **historical coding-agent traces**, pivot into **Cursor SaaS tools**, and—on October 29—plant **unauthorized builds of Anthropic's Claude Code extension** in the **marketplace cache** that serves Cursor's VS Code extension store.\n\nThis is not a new outage headline. It is the **supplier-to-marketplace** story security teams have been piecing together since the [malicious `anthropic.claude-code` 2.1.313 build](https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026) surfaced in late October. Cursor's post adds **official numbers**, a **timeline**, and **remediation** that tie the extension event to the wider [Fireworks October breach](https://explainx.ai/blog/fireworks-october-2026-security-incident-update-billing-weights-november-2026).\n\n## TL;DR: what Cursor says happened\n\n| Stage | What Cursor reports | Who was affected | \n|---|---|---|\n| Vendor key | Fireworks exposed a Cursor-issued key; attacker copied a read-only shared bucket | Traces mostly from 2025, not Privacy Mode sessions | \n| Credential pivot | Unredacted API credentials in traces (under 0.01% of customers) reached SaaS tools | Archived repos, support mail, usage metrics, some conversation summaries | \n| Marketplace malware | Stolen internal credential used to cache malicious Claude Code **2.1.312 / 2.1.313** | Up to **5,000** users requesting those versions Oct 29 (~11 hours) | \n| Containment | Key cut off, inference moved off Fireworks, last activity **Nov 1** blocked | Direct email to affected accounts; majority untouched per Cursor | \n\nAgents that act on your behalf need rules. [See how explainx helps secure your agents →](https://explainx.ai/agentbeam?src=blog_note)\n\n## Why this matters for anyone building with coding agents\n\nModern agent harnesses do not live in a single repository. They call **inference vendors**, store **evaluation traces**, sync **extensions**, and mirror **support credentials** across SaaS tools. When one vendor key can read a bucket that was meant for **offline training analysis**, the blast radius is not \"their cloud\"—it is **your API keys in logs**, **your marketplace cache**, and **your users' laptops**.\n\nThat pattern matches what Alex Stamos described on Decoder as **breach chaining** through AI suppliers ([our summary](https://explainx.ai/blog/alex-stamos-decoder-ai-cybersecurity-dark-age-november-2026)), and it sits in the same October wave as [Notion AI transcripts on Fireworks](https://explainx.ai/blog/notion-ai-fireworks-chat-transcripts-exposed-november-2026) and [LLMjacking-driven weight theft](https://explainx.ai/blog/fireworks-october-2026-security-incident-update-billing-weights-november-2026).\n\nIf you treat Cursor, Copilot, or Claude Code as production tooling, this incident is a case study in **third-party trace storage**, not just extension hygiene.\n\nA green lens highlights one weak link in a cream supply chain in a Cursor Fireworks breach diagram\n\n## Step 1: Fireworks and the shared trace bucket\n\nCursor's narrative opens with a blunt sentence: **\"It started at Fireworks.\"** The company says it had issued an access key to Fireworks and used a **read-only storage bucket** to share data with that vendor. After Fireworks exposed the key—details of the exposure live in Fireworks' own [October and November bulletins](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=explainx)—an attacker copied bucket contents.\n\nWhat was inside, according to Cursor:\n\n- **Limited coding-agent traces** , mostly from**2025**\n- Sessions **not in Privacy Mode** , which Cursor says it was**permitted to use for model training**\n- A **small number of traces with credentials that had not been redacted**\n\nImpact fractions from Cursor:\n\n- **Fewer than 0.05% of users** had traces in the bucket\n- **Less than 0.01% of customers** had**API credentials** exposed via those traces\n\nCursor emphasizes that **live prompts and code you send today** were not in that path—the bucket was for **historical offline analysis**. **Privacy Mode** users' prompts and code are listed under **what was not affected**.\n\nFor builders, the lesson is mechanical: **any trace your harness exports to a vendor for tuning or eval becomes durable attack surface** unless redaction and retention are enforced upstream. That is separate from whether Fireworks' **zero-retention inference** paths stayed clean—Fireworks continues to distinguish inference from stored artifacts in its bulletins.\n\n## Step 2: Lateral movement through Cursor's SaaS plane\n\nStarting from credentials found in traces, Cursor says the attacker reached **select SaaS tools used by Cursor** and from there accessed:\n\n- **Archived non-production source repositories** (some with business contact information)\n- **Limited customer support data and email threads**\n- **Product usage metrics and contact details**\n- **Summaries of some coding-agent conversations**\n- **Credentials users had sent to Cursor support**\n\nCursor does **not** say customer Git remotes were accessed. Production systems that run Cursor, release signing keys, the Cursor app update channel, **customer code repositories**, **Cloud Agents for customer teams**, and **active inference requests** are all listed as **not affected**.\n\nDetection and response, per Cursor:\n\n- Internal monitoring flagged unauthorized activity\n- Cursor **deactivated the Fireworks key** , opened an incident response workstream, and**rotated credentials** as access was found\n- Some Cursor features were **temporarily disabled beyond what evidence required** , then restored when safe\n\nThat \"pause the product to pause the attacker\" choice matters for teams who lived through [Claude authentication outages](https://explainx.ai/blog/claude-authentication-outage-claude-ai-code-november-13-2026) in the same month: agent platforms now trade **feature uptime** against **containment speed** during supplier breaches.\n\nA vault door with a green key beside it illustrates exposed vendor credentials after a Fireworks breach\n\n## Step 3: Malicious Claude Code builds in the marketplace cache\n\nThe October 29 extension event is the piece most developers already heard about. Cursor now places it **after** the Fireworks bucket copy and SaaS pivot:\n\n- On **October 29** , using a**stolen credential from exposed internal data** , the attacker placed**malicious, unauthorized copies** of Anthropic's Claude Code extension on the**cache** that serves Cursor's VS Code extension marketplace\n- Versions named: **`anthropic.claude-code` 2.1.312 and 2.1.313**\n- **Anthropic did not publish** these builds; Cursor states this was**not** an Anthropic product vulnerability\n- **Open VSX never had the malware**\n- At most **5,000 users** who requested those**cached** versions on October 29 may have received the malicious build\n- Exposure window: **approximately 11 hours** before removal; marketplace taken offline; attacker C2 host worked with CSP to take down\n\nThis aligns with the [OpenSourceMalware analysis](https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026) of **2.1.313** planting SSH persistence, while Cursor's November post adds the **Fireworks root cause** and confirms **2.1.312** in the same cache attack.\n\n**Critical remediation note from Cursor:** if you installed or updated to those versions from the **Cursor marketplace during the window**, follow the steps in Cursor's October 30 security notice. **Uninstalling the extension alone may not be enough**—the same warning researchers gave when describing persistence outside the extension folder.\n\n## What Cursor changed after the incident\n\nCursor lists concrete supplier and platform moves:\n\n- **Moved all inference traffic off Fireworks** , deactivated the vendor key, and cut Fireworks off shared datasets\n- **Rotated every exposed credential** plus precautionary rotation across internal systems\n- **Validated other marketplace extensions** , then**reviewed and rebuilt** the VS Code extension marketplace\n- **Expanded network restrictions** on service providers so stolen keys cannot be used outside intended locations\n- **Added secret scanning** across repositories and more internal data sources\n- **Redeployed production infrastructure** and reviewed internal services before restore\n- **Engaged external forensics**\n\nLast attacker activity Cursor reports: **November 1**, blocked. The company says the incident is **contained** but will update the post if new customer-impacting facts appear. Questions route to **[security@cursor.com](mailto:security@cursor.com)**.\n\n## How this fits the October AI vendor breach wave\n\nFireworks' November 9 bulletin already widened impact to **billing data** and **incomplete model weights** for some customers, and press outlets quoted Fireworks naming **Notion and Cursor** among companies it was supporting. Cursor's November 13 post is the **first primary-source** description of **what Fireworks access meant inside a coding-agent vendor**.\n\nThe sequence—**vendor key → training traces → SaaS → signed-adjacent distribution channel**—is why explainx.ai tracks these stories beside [agent breach timelines](https://explainx.ai/blog/november-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026) and [ARTEX-style autonomous attack reporting](https://explainx.ai/blog/fbi-artex-flash-warning-agentic-ai-cyberattacks-november-2026).\n\nIt is also why **Privacy Mode** is not a privacy nicety. Cursor explicitly separates **Privacy Mode users** from the trace bucket used for vendor sharing. Teams that left training-friendly logging on for convenience traded **model improvement** for **retained secrets in a third-party blast radius**.\n\n## What developers should do this week\n\n**If you run Cursor in a team:**\n\n1. Confirm whether admins received **direct incident mail** —Cursor says silent inboxes mean your trace data was not in the bucket.\n2. Re-read **Privacy Mode** defaults for repos that touch production secrets ([enterprise privacy docs](https://cursor.com/security?ref=explainx) describe inheritance on team join).\n3. If anyone installed **2.1.312 or 2.1.313** from the Cursor marketplace on**October 29** , run Cursor's published IOC scripts and assume**host-level persistence** until proven clean.\n4. **Rotate API keys** that ever lived in agent prompts, Composer logs, or support tickets—especially cloud keys with broad IAM.\n5. Map **subprocessors** : Cursor's trust portal lists vendors; reconcile any that still hold**historical traces** you did not know about.\n\n**If you fine-tune or eval on Fireworks (or similar hosts):**\n\n- Treat dataset uploads and shared buckets as **credential archives** , not disposable sandboxes.\n- Cap key budgets and scope permissions so stolen keys cannot run unbounded inference—same playbook as [Fireworks' own October notice](https://fireworks.ai/security/bulletins/october-2026-security-incident?ref=explainx) .\n- Consider whether **routing** choices ([Cursor Router](https://explainx.ai/blog/cursor-router-auto-model-selection-july-2026) vs single-vendor fine-tunes) increase the number of parties that can see traces.\n\n**If you ship extensions or agent skills:**\n\n- Delay automatic extension updates where your editor supports cooldown settings; our [Claude Code extension trojan post](https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026) explains why uninstall alone failed.\n- Monitor marketplace **cache layers** , not only upstream registries—Open VSX was clean while Cursor's cache was not.\n\nFor agent-side guardrails on trace handling and risky tool calls, see [AgentBeam](https://agentbeam.com/?ref=explainx), the agent security platform from the explainx.ai team.\n\n## What people are asking\n\n**Did Fireworks admit exposing Cursor's key?** Fireworks' public bulletins describe credential theft and October chains without narrating every downstream customer. Cursor's post is explicit that **Fireworks exposed the key**. For Fireworks-specific facts, anchor on [Fireworks bulletins](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=explainx); for Cursor impact, anchor on [Cursor's update](https://cursor.com/blog/security-incident-update?ref=explainx).\n\n**Should I stop using Cursor?** Cursor says production systems, signing keys, customer repos, and live traffic were not affected. The actionable risk clusters on **historical traces without Privacy Mode**, **support-sent credentials**, and **the October 29 extension window**—not on everyday typing in Privacy Mode today.\n\n**Is this the same as the Claude Code 2.1.323 observability release?** No. [Claude Code 2.1.323](https://explainx.ai/blog/claude-code-2-1-323-removes-subagentstatusline-agent-panel-observability-2026) is a product release thread. The malicious builds are **2.1.312 and 2.1.313** in Cursor's cache only.\n\n**How does this compare to npm or PyPI supply-chain attacks?** Similar user exposure (developers install trusting the brand), but the entry path here is **AI vendor trace storage plus internal SaaS**, not a public package index typo-squat. That is closer to [credential theft via agent tooling](https://explainx.ai/blog/chainalysis-breach-password-hashes-live-tokens-all-customers-agentic-techniques-what-to-do-2026) than to a lone malicious README.\n\n## Related reading\n\n*Details reflect Cursor's November 13, 2026 post and Fireworks bulletins as of November 14, 2026.*", "url": "https://wpnews.pro/news/cursor-links-fireworks-breach-to-agent-traces-and-marketplace-malware", "canonical_source": "https://explainx.ai/blog/cursor-fireworks-security-incident-agent-traces-november-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog", "published_at": "2026-11-14 00:00:00+00:00", "updated_at": "2026-11-14 06:22:49.343265+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools", "developer-tools"], "entities": ["Cursor", "Fireworks AI", "Anthropic", "Claude Code", "Alex Stamos", "Notion AI", "VS Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cursor-links-fireworks-breach-to-agent-traces-and-marketplace-malware", "markdown": "https://wpnews.pro/news/cursor-links-fireworks-breach-to-agent-traces-and-marketplace-malware.md", "text": "https://wpnews.pro/news/cursor-links-fireworks-breach-to-agent-traces-and-marketplace-malware.txt", "jsonld": "https://wpnews.pro/news/cursor-links-fireworks-breach-to-agent-traces-and-marketplace-malware.jsonld"}}