Cursor Links Fireworks Breach to Agent Traces and Marketplace Malware

Cursor published a November 13, 2026 account of its October security incident, stating that an attacker used a Cursor-issued access key exposed by Fireworks AI to copy historical coding-agent traces, pivot into Cursor SaaS tools, and on October 29 plant unauthorized builds of Anthropic's Claude Code extension (versions 2.1.312 and 2.1.313) in the marketplace cache serving Cursor's VS Code extension store. Cursor said the malicious builds reached up to 5,000 users who requested those versions over roughly 11 hours on October 29, that unredacted API credentials appeared in traces affecting under 0.01% of customers, and that it cut off the key, moved inference off Fireworks, and blocked last attacker activity on November 1. The copied traces were mostly from 2025 and came from sessions not in Privacy Mode, which Cursor said it was permitted to use for model training.

Cursor on November 13, 2026 published the fullest account yet of its October security incident , naming Fireworks AI https://fireworks.ai/?ref=explainx as the place the chain started. In An update on our recent security incident https://cursor.com/blog/security-incident-update?ref=explainx , Cursor says an attacker used a Cursor-issued access key exposed by Fireworks to copy historical coding-agent traces , pivot into Cursor SaaS tools , and—on October 29—plant unauthorized builds of Anthropic's Claude Code extension in the marketplace cache that serves Cursor's VS Code extension store. This is not a new outage headline. It is the supplier-to-marketplace story security teams have been piecing together since the malicious anthropic.claude-code 2.1.313 build https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026 surfaced in late October. Cursor's post adds official numbers , a timeline , and remediation that tie the extension event to the wider Fireworks October breach https://explainx.ai/blog/fireworks-october-2026-security-incident-update-billing-weights-november-2026 . TL;DR: what Cursor says happened | Stage | What Cursor reports | Who was affected | |---|---|---| | Vendor key | Fireworks exposed a Cursor-issued key; attacker copied a read-only shared bucket | Traces mostly from 2025, not Privacy Mode sessions | | Credential pivot | Unredacted API credentials in traces under 0.01% of customers reached SaaS tools | Archived repos, support mail, usage metrics, some conversation summaries | | Marketplace malware | Stolen internal credential used to cache malicious Claude Code 2.1.312 / 2.1.313 | Up to 5,000 users requesting those versions Oct 29 ~11 hours | | Containment | Key cut off, inference moved off Fireworks, last activity Nov 1 blocked | Direct email to affected accounts; majority untouched per Cursor | Agents that act on your behalf need rules. See how explainx helps secure your agents → https://explainx.ai/agentbeam?src=blog note Why this matters for anyone building with coding agents Modern agent harnesses do not live in a single repository. They call inference vendors , store evaluation traces , sync extensions , and mirror support credentials across SaaS tools. When one vendor key can read a bucket that was meant for offline training analysis , the blast radius is not "their cloud"—it is your API keys in logs , your marketplace cache , and your users' laptops . That pattern matches what Alex Stamos described on Decoder as breach chaining through AI suppliers our summary https://explainx.ai/blog/alex-stamos-decoder-ai-cybersecurity-dark-age-november-2026 , and it sits in the same October wave as Notion AI transcripts on Fireworks https://explainx.ai/blog/notion-ai-fireworks-chat-transcripts-exposed-november-2026 and LLMjacking-driven weight theft https://explainx.ai/blog/fireworks-october-2026-security-incident-update-billing-weights-november-2026 . If you treat Cursor, Copilot, or Claude Code as production tooling, this incident is a case study in third-party trace storage , not just extension hygiene. A green lens highlights one weak link in a cream supply chain in a Cursor Fireworks breach diagram Step 1: Fireworks and the shared trace bucket Cursor's narrative opens with a blunt sentence: "It started at Fireworks." The company says it had issued an access key to Fireworks and used a read-only storage bucket to share data with that vendor. After Fireworks exposed the key—details of the exposure live in Fireworks' own October and November bulletins https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=explainx —an attacker copied bucket contents. What was inside, according to Cursor: - Limited coding-agent traces , mostly from 2025 - Sessions not in Privacy Mode , which Cursor says it was permitted to use for model training - A small number of traces with credentials that had not been redacted Impact fractions from Cursor: - Fewer than 0.05% of users had traces in the bucket - Less than 0.01% of customers had API credentials exposed via those traces Cursor emphasizes that live prompts and code you send today were not in that path—the bucket was for historical offline analysis . Privacy Mode users' prompts and code are listed under what was not affected . For builders, the lesson is mechanical: any trace your harness exports to a vendor for tuning or eval becomes durable attack surface unless redaction and retention are enforced upstream. That is separate from whether Fireworks' zero-retention inference paths stayed clean—Fireworks continues to distinguish inference from stored artifacts in its bulletins. Step 2: Lateral movement through Cursor's SaaS plane Starting from credentials found in traces, Cursor says the attacker reached select SaaS tools used by Cursor and from there accessed: - Archived non-production source repositories some with business contact information - Limited customer support data and email threads - Product usage metrics and contact details - Summaries of some coding-agent conversations - Credentials users had sent to Cursor support Cursor does not say customer Git remotes were accessed. Production systems that run Cursor, release signing keys, the Cursor app update channel, customer code repositories , Cloud Agents for customer teams , and active inference requests are all listed as not affected . Detection and response, per Cursor: - Internal monitoring flagged unauthorized activity - Cursor deactivated the Fireworks key , opened an incident response workstream, and rotated credentials as access was found - Some Cursor features were temporarily disabled beyond what evidence required , then restored when safe That "pause the product to pause the attacker" choice matters for teams who lived through Claude authentication outages https://explainx.ai/blog/claude-authentication-outage-claude-ai-code-november-13-2026 in the same month: agent platforms now trade feature uptime against containment speed during supplier breaches. A vault door with a green key beside it illustrates exposed vendor credentials after a Fireworks breach Step 3: Malicious Claude Code builds in the marketplace cache The October 29 extension event is the piece most developers already heard about. Cursor now places it after the Fireworks bucket copy and SaaS pivot: - On October 29 , using a stolen credential from exposed internal data , the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension on the cache that serves Cursor's VS Code extension marketplace - Versions named: anthropic.claude-code 2.1.312 and 2.1.313 - Anthropic did not publish these builds; Cursor states this was not an Anthropic product vulnerability - Open VSX never had the malware - At most 5,000 users who requested those cached versions on October 29 may have received the malicious build - Exposure window: approximately 11 hours before removal; marketplace taken offline; attacker C2 host worked with CSP to take down This aligns with the OpenSourceMalware analysis https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026 of 2.1.313 planting SSH persistence, while Cursor's November post adds the Fireworks root cause and confirms 2.1.312 in the same cache attack. Critical remediation note from Cursor: if you installed or updated to those versions from the Cursor marketplace during the window , follow the steps in Cursor's October 30 security notice. Uninstalling the extension alone may not be enough —the same warning researchers gave when describing persistence outside the extension folder. What Cursor changed after the incident Cursor lists concrete supplier and platform moves: - Moved all inference traffic off Fireworks , deactivated the vendor key, and cut Fireworks off shared datasets - Rotated every exposed credential plus precautionary rotation across internal systems - Validated other marketplace extensions , then reviewed and rebuilt the VS Code extension marketplace - Expanded network restrictions on service providers so stolen keys cannot be used outside intended locations - Added secret scanning across repositories and more internal data sources - Redeployed production infrastructure and reviewed internal services before restore - Engaged external forensics Last attacker activity Cursor reports: November 1 , blocked. The company says the incident is contained but will update the post if new customer-impacting facts appear. Questions route to security@cursor.com mailto:security@cursor.com . How this fits the October AI vendor breach wave Fireworks' November 9 bulletin already widened impact to billing data and incomplete model weights for some customers, and press outlets quoted Fireworks naming Notion and Cursor among companies it was supporting. Cursor's November 13 post is the first primary-source description of what Fireworks access meant inside a coding-agent vendor . The sequence— vendor key → training traces → SaaS → signed-adjacent distribution channel —is why explainx.ai tracks these stories beside agent breach timelines https://explainx.ai/blog/november-2026-cyberattacks-list-breaches-exploits-ai-run-attacks-tracker-2026 and ARTEX-style autonomous attack reporting https://explainx.ai/blog/fbi-artex-flash-warning-agentic-ai-cyberattacks-november-2026 . It is also why Privacy Mode is not a privacy nicety. Cursor explicitly separates Privacy Mode users from the trace bucket used for vendor sharing. Teams that left training-friendly logging on for convenience traded model improvement for retained secrets in a third-party blast radius . What developers should do this week If you run Cursor in a team: 1. Confirm whether admins received direct incident mail —Cursor says silent inboxes mean your trace data was not in the bucket. 2. Re-read Privacy Mode defaults for repos that touch production secrets enterprise privacy docs https://cursor.com/security?ref=explainx describe inheritance on team join . 3. If anyone installed 2.1.312 or 2.1.313 from the Cursor marketplace on October 29 , run Cursor's published IOC scripts and assume host-level persistence until proven clean. 4. Rotate API keys that ever lived in agent prompts, Composer logs, or support tickets—especially cloud keys with broad IAM. 5. Map subprocessors : Cursor's trust portal lists vendors; reconcile any that still hold historical traces you did not know about. If you fine-tune or eval on Fireworks or similar hosts : - Treat dataset uploads and shared buckets as credential archives , not disposable sandboxes. - Cap key budgets and scope permissions so stolen keys cannot run unbounded inference—same playbook as Fireworks' own October notice https://fireworks.ai/security/bulletins/october-2026-security-incident?ref=explainx . - Consider whether routing choices Cursor Router https://explainx.ai/blog/cursor-router-auto-model-selection-july-2026 vs single-vendor fine-tunes increase the number of parties that can see traces. If you ship extensions or agent skills: - Delay automatic extension updates where your editor supports cooldown settings; our Claude Code extension trojan post https://explainx.ai/blog/claude-code-extension-trojanized-2-1-313-cursor-marketplace-ssh-backdoor-what-is-confirmed-2026 explains why uninstall alone failed. - Monitor marketplace cache layers , not only upstream registries—Open VSX was clean while Cursor's cache was not. For agent-side guardrails on trace handling and risky tool calls, see AgentBeam https://agentbeam.com/?ref=explainx , the agent security platform from the explainx.ai team. What people are asking Did Fireworks admit exposing Cursor's key? Fireworks' public bulletins describe credential theft and October chains without narrating every downstream customer. Cursor's post is explicit that Fireworks exposed the key . For Fireworks-specific facts, anchor on Fireworks bulletins https://fireworks.ai/security/bulletins/october-2026-security-incident-update?ref=explainx ; for Cursor impact, anchor on Cursor's update https://cursor.com/blog/security-incident-update?ref=explainx . Should I stop using Cursor? Cursor says production systems, signing keys, customer repos, and live traffic were not affected. The actionable risk clusters on historical traces without Privacy Mode , support-sent credentials , and the October 29 extension window —not on everyday typing in Privacy Mode today. Is this the same as the Claude Code 2.1.323 observability release? No. Claude Code 2.1.323 https://explainx.ai/blog/claude-code-2-1-323-removes-subagentstatusline-agent-panel-observability-2026 is a product release thread. The malicious builds are 2.1.312 and 2.1.313 in Cursor's cache only. How does this compare to npm or PyPI supply-chain attacks? Similar user exposure developers install trusting the brand , but the entry path here is AI vendor trace storage plus internal SaaS , not a public package index typo-squat. That is closer to credential theft via agent tooling https://explainx.ai/blog/chainalysis-breach-password-hashes-live-tokens-all-customers-agentic-techniques-what-to-do-2026 than to a lone malicious README. Related reading Details reflect Cursor's November 13, 2026 post and Fireworks bulletins as of November 14, 2026.