# Cursor Links Fireworks Breach to Agent Traces and Marketplace Malware

> Source: <https://explainx.ai/blog/cursor-fireworks-security-incident-agent-traces-november-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog>
> Published: 2026-11-14 00:00:00+00:00

**Cursor on November 13, 2026 published the fullest account yet of its October security incident**, naming [Fireworks AI](https://fireworks.ai/?ref=explainx) as the place the chain started. In [An update on our recent security incident](https://cursor.com/blog/security-incident-update?ref=explainx), Cursor says an attacker used a **Cursor-issued access key exposed by Fireworks** to copy **historical coding-agent traces**, pivot into **Cursor SaaS tools**, and—on October 29—plant **unauthorized builds of Anthropic's Claude Code extension** in the **marketplace cache** that serves Cursor's VS Code extension store.

This is not a new outage headline. It is the **supplier-to-marketplace** story security teams have been piecing together since the [malicious `anthropic.claude-code` 2.1.313 build](https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026) surfaced in late October. Cursor's post adds **official numbers**, a **timeline**, and **remediation** that tie the extension event to the wider [Fireworks October breach](https://explainx.ai/blog/fireworks-october-2026-security-incident-update-billing-weights-november-2026).

## TL;DR: what Cursor says happened

| Stage | What Cursor reports | Who was affected | 
|---|---|---|
| Vendor key | Fireworks exposed a Cursor-issued key; attacker copied a read-only shared bucket | Traces mostly from 2025, not Privacy Mode sessions | 
| Credential pivot | Unredacted API credentials in traces (under 0.01% of customers) reached SaaS tools | Archived repos, support mail, usage metrics, some conversation summaries | 
| Marketplace malware | Stolen internal credential used to cache malicious Claude Code **2.1.312 / 2.1.313** | Up to **5,000** users requesting those versions Oct 29 (~11 hours) | 
| Containment | Key cut off, inference moved off Fireworks, last activity **Nov 1** blocked | Direct email to affected accounts; majority untouched per Cursor | 

Agents that act on your behalf need rules. [See how explainx helps secure your agents →](https://explainx.ai/agentbeam?src=blog_note)

## Why this matters for anyone building with coding agents

Modern agent harnesses do not live in a single repository. They call **inference vendors**, store **evaluation traces**, sync **extensions**, and mirror **support credentials** across SaaS tools. When one vendor key can read a bucket that was meant for **offline training analysis**, the blast radius is not "their cloud"—it is **your API keys in logs**, **your marketplace cache**, and **your users' laptops**.

That pattern matches what Alex Stamos described on Decoder as **breach chaining** through AI suppliers ([our summary](https://explainx.ai/blog/alex-stamos-decoder-ai-cybersecurity-dark-age-november-2026)), and it sits in the same October wave as [Notion AI transcripts on Fireworks](https://explainx.ai/blog/notion-ai-fireworks-chat-transcripts-exposed-november-2026) and [LLMjacking-driven weight theft](https://explainx.ai/blog/fireworks-october-2026-security-incident-update-billing-weights-november-2026).

If you treat Cursor, Copilot, or Claude Code as production tooling, this incident is a case study in **third-party trace storage**, not just extension hygiene.

A green lens highlights one weak link in a cream supply chain in a Cursor Fireworks breach diagram

## Step 1: Fireworks and the shared trace bucket

Cursor's narrative opens with a blunt sentence: **"It started at Fireworks."** The company says it had issued an access key to Fireworks and used a **read-only storage bucket** to share data with that vendor. After Fireworks exposed the key—details of the exposure live in Fireworks' own [October and November bulletins](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=explainx)—an attacker copied bucket contents.

What was inside, according to Cursor:

- **Limited coding-agent traces** , mostly from**2025**
- Sessions **not in Privacy Mode** , which Cursor says it was**permitted to use for model training**
- A **small number of traces with credentials that had not been redacted**

Impact fractions from Cursor:

- **Fewer than 0.05% of users** had traces in the bucket
- **Less than 0.01% of customers** had**API credentials** exposed via those traces

Cursor emphasizes that **live prompts and code you send today** were not in that path—the bucket was for **historical offline analysis**. **Privacy Mode** users' prompts and code are listed under **what was not affected**.

For builders, the lesson is mechanical: **any trace your harness exports to a vendor for tuning or eval becomes durable attack surface** unless redaction and retention are enforced upstream. That is separate from whether Fireworks' **zero-retention inference** paths stayed clean—Fireworks continues to distinguish inference from stored artifacts in its bulletins.

## Step 2: Lateral movement through Cursor's SaaS plane

Starting from credentials found in traces, Cursor says the attacker reached **select SaaS tools used by Cursor** and from there accessed:

- **Archived non-production source repositories** (some with business contact information)
- **Limited customer support data and email threads**
- **Product usage metrics and contact details**
- **Summaries of some coding-agent conversations**
- **Credentials users had sent to Cursor support**

Cursor does **not** say customer Git remotes were accessed. Production systems that run Cursor, release signing keys, the Cursor app update channel, **customer code repositories**, **Cloud Agents for customer teams**, and **active inference requests** are all listed as **not affected**.

Detection and response, per Cursor:

- Internal monitoring flagged unauthorized activity
- Cursor **deactivated the Fireworks key** , opened an incident response workstream, and**rotated credentials** as access was found
- Some Cursor features were **temporarily disabled beyond what evidence required** , then restored when safe

That "pause the product to pause the attacker" choice matters for teams who lived through [Claude authentication outages](https://explainx.ai/blog/claude-authentication-outage-claude-ai-code-november-13-2026) in the same month: agent platforms now trade **feature uptime** against **containment speed** during supplier breaches.

A vault door with a green key beside it illustrates exposed vendor credentials after a Fireworks breach

## Step 3: Malicious Claude Code builds in the marketplace cache

The October 29 extension event is the piece most developers already heard about. Cursor now places it **after** the Fireworks bucket copy and SaaS pivot:

- On **October 29** , using a**stolen credential from exposed internal data** , the attacker placed**malicious, unauthorized copies** of Anthropic's Claude Code extension on the**cache** that serves Cursor's VS Code extension marketplace
- Versions named: **`anthropic.claude-code` 2.1.312 and 2.1.313**
- **Anthropic did not publish** these builds; Cursor states this was**not** an Anthropic product vulnerability
- **Open VSX never had the malware**
- At most **5,000 users** who requested those**cached** versions on October 29 may have received the malicious build
- Exposure window: **approximately 11 hours** before removal; marketplace taken offline; attacker C2 host worked with CSP to take down

This aligns with the [OpenSourceMalware analysis](https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026) of **2.1.313** planting SSH persistence, while Cursor's November post adds the **Fireworks root cause** and confirms **2.1.312** in the same cache attack.

**Critical remediation note from Cursor:** if you installed or updated to those versions from the **Cursor marketplace during the window**, follow the steps in Cursor's October 30 security notice. **Uninstalling the extension alone may not be enough**—the same warning researchers gave when describing persistence outside the extension folder.

## What Cursor changed after the incident

Cursor lists concrete supplier and platform moves:

- **Moved all inference traffic off Fireworks** , deactivated the vendor key, and cut Fireworks off shared datasets
- **Rotated every exposed credential** plus precautionary rotation across internal systems
- **Validated other marketplace extensions** , then**reviewed and rebuilt** the VS Code extension marketplace
- **Expanded network restrictions** on service providers so stolen keys cannot be used outside intended locations
- **Added secret scanning** across repositories and more internal data sources
- **Redeployed production infrastructure** and reviewed internal services before restore
- **Engaged external forensics**

Last attacker activity Cursor reports: **November 1**, blocked. The company says the incident is **contained** but will update the post if new customer-impacting facts appear. Questions route to **[security@cursor.com](mailto:security@cursor.com)**.

## How this fits the October AI vendor breach wave

Fireworks' November 9 bulletin already widened impact to **billing data** and **incomplete model weights** for some customers, and press outlets quoted Fireworks naming **Notion and Cursor** among companies it was supporting. Cursor's November 13 post is the **first primary-source** description of **what Fireworks access meant inside a coding-agent vendor**.

The sequence—**vendor key → training traces → SaaS → signed-adjacent distribution channel**—is why explainx.ai tracks these stories beside [agent breach timelines](https://explainx.ai/blog/november-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026) and [ARTEX-style autonomous attack reporting](https://explainx.ai/blog/fbi-artex-flash-warning-agentic-ai-cyberattacks-november-2026).

It is also why **Privacy Mode** is not a privacy nicety. Cursor explicitly separates **Privacy Mode users** from the trace bucket used for vendor sharing. Teams that left training-friendly logging on for convenience traded **model improvement** for **retained secrets in a third-party blast radius**.

## What developers should do this week

**If you run Cursor in a team:**

1. Confirm whether admins received **direct incident mail** —Cursor says silent inboxes mean your trace data was not in the bucket.
2. Re-read **Privacy Mode** defaults for repos that touch production secrets ([enterprise privacy docs](https://cursor.com/security?ref=explainx) describe inheritance on team join).
3. If anyone installed **2.1.312 or 2.1.313** from the Cursor marketplace on**October 29** , run Cursor's published IOC scripts and assume**host-level persistence** until proven clean.
4. **Rotate API keys** that ever lived in agent prompts, Composer logs, or support tickets—especially cloud keys with broad IAM.
5. Map **subprocessors** : Cursor's trust portal lists vendors; reconcile any that still hold**historical traces** you did not know about.

**If you fine-tune or eval on Fireworks (or similar hosts):**

- Treat dataset uploads and shared buckets as **credential archives** , not disposable sandboxes.
- Cap key budgets and scope permissions so stolen keys cannot run unbounded inference—same playbook as [Fireworks' own October notice](https://fireworks.ai/security/bulletins/october-2026-security-incident?ref=explainx) .
- Consider whether **routing** choices ([Cursor Router](https://explainx.ai/blog/cursor-router-auto-model-selection-july-2026) vs single-vendor fine-tunes) increase the number of parties that can see traces.

**If you ship extensions or agent skills:**

- Delay automatic extension updates where your editor supports cooldown settings; our [Claude Code extension trojan post](https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026) explains why uninstall alone failed.
- Monitor marketplace **cache layers** , not only upstream registries—Open VSX was clean while Cursor's cache was not.

For agent-side guardrails on trace handling and risky tool calls, see [AgentBeam](https://agentbeam.com/?ref=explainx), the agent security platform from the explainx.ai team.

## What people are asking

**Did Fireworks admit exposing Cursor's key?** Fireworks' public bulletins describe credential theft and October chains without narrating every downstream customer. Cursor's post is explicit that **Fireworks exposed the key**. For Fireworks-specific facts, anchor on [Fireworks bulletins](https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=explainx); for Cursor impact, anchor on [Cursor's update](https://cursor.com/blog/security-incident-update?ref=explainx).

**Should I stop using Cursor?** Cursor says production systems, signing keys, customer repos, and live traffic were not affected. The actionable risk clusters on **historical traces without Privacy Mode**, **support-sent credentials**, and **the October 29 extension window**—not on everyday typing in Privacy Mode today.

**Is this the same as the Claude Code 2.1.323 observability release?** No. [Claude Code 2.1.323](https://explainx.ai/blog/claude-code-2-1-323-removes-subagentstatusline-agent-panel-observability-2026) is a product release thread. The malicious builds are **2.1.312 and 2.1.313** in Cursor's cache only.

**How does this compare to npm or PyPI supply-chain attacks?** Similar user exposure (developers install trusting the brand), but the entry path here is **AI vendor trace storage plus internal SaaS**, not a public package index typo-squat. That is closer to [credential theft via agent tooling](https://explainx.ai/blog/chainalysis-breach-password-hashes-live-tokens-all-customers-agentic-techniques-what-to-do-2026) than to a lone malicious README.

## Related reading

*Details reflect Cursor's November 13, 2026 post and Fireworks bulletins as of November 14, 2026.*