Cursor Links Fireworks Breach to Agent Traces and Marketplace Malware

Cursor on November 13, 2026 published the fullest account yet of its October security incident, naming Fireworks AI as the place the chain started. In An update on our recent security incident, Cursor says an attacker used a Cursor-issued access key exposed by Fireworks to copy historical coding-agent traces, pivot into Cursor SaaS tools, and—on October 29—plant unauthorized builds of Anthropic's Claude Code extension in the marketplace cache that serves Cursor's VS Code extension store.

This is not a new outage headline. It is the supplier-to-marketplace story security teams have been piecing together since the malicious anthropic.claude-code 2.1.313 build surfaced in late October. Cursor's post adds official numbers, a timeline, and remediation that tie the extension event to the wider Fireworks October breach.

TL;DR: what Cursor says happened

Agents that act on your behalf need rules. See how explainx helps secure your agents →

Why this matters for anyone building with coding agents

Modern agent harnesses do not live in a single repository. They call inference vendors, store evaluation traces, sync extensions, and mirror support credentials across SaaS tools. When one vendor key can read a bucket that was meant for offline training analysis, the blast radius is not "their cloud"—it is your API keys in logs, your marketplace cache, and your users' laptops.

That pattern matches what Alex Stamos described on Decoder as breach chaining through AI suppliers (our summary), and it sits in the same October wave as Notion AI transcripts on Fireworks and LLMjacking-driven weight theft.

If you treat Cursor, Copilot, or Claude Code as production tooling, this incident is a case study in third-party trace storage, not just extension hygiene.

A green lens highlights one weak link in a cream supply chain in a Cursor Fireworks breach diagram

Step 1: Fireworks and the shared trace bucket

Cursor's narrative opens with a blunt sentence: "It started at Fireworks." The company says it had issued an access key to Fireworks and used a read-only storage bucket to share data with that vendor. After Fireworks exposed the key—details of the exposure live in Fireworks' own October and November bulletins—an attacker copied bucket contents.

What was inside, according to Cursor:

• Limited coding-agent traces, mostly from 2025
• Sessions not in Privacy Mode, which Cursor says it was permitted to use for model training
• A small number of traces with credentials that had not been redacted

Impact fractions from Cursor:

• Fewer than 0.05% of users had traces in the bucket
• Less than 0.01% of customers had API credentials exposed via those traces

Cursor emphasizes that live prompts and code you send today were not in that path—the bucket was for historical offline analysis. Privacy Mode users' prompts and code are listed under what was not affected.

For builders, the lesson is mechanical: any trace your harness exports to a vendor for tuning or eval becomes durable attack surface unless redaction and retention are enforced upstream. That is separate from whether Fireworks' zero-retention inference paths stayed clean—Fireworks continues to distinguish inference from stored artifacts in its bulletins.

Step 2: Lateral movement through Cursor's SaaS plane

Starting from credentials found in traces, Cursor says the attacker reached select SaaS tools used by Cursor and from there accessed:

• Archived non-production source repositories (some with business contact information)
• Limited customer support data and email threads
• Product usage metrics and contact details
• Summaries of some coding-agent conversations
• Credentials users had sent to Cursor support

Cursor does not say customer Git remotes were accessed. Production systems that run Cursor, release signing keys, the Cursor app update channel, customer code repositories, Cloud Agents for customer teams, and active inference requests are all listed as not affected.

Detection and response, per Cursor:

• Internal monitoring flagged unauthorized activity
• Cursor deactivated the Fireworks key, opened an incident response workstream, and rotated credentials as access was found
• Some Cursor features were temporarily disabled beyond what evidence required, then restored when safe

That "pause the product to pause the attacker" choice matters for teams who lived through Claude authentication outages in the same month: agent platforms now trade feature uptime against containment speed during supplier breaches.

A vault door with a green key beside it illustrates exposed vendor credentials after a Fireworks breach

Step 3: Malicious Claude Code builds in the marketplace cache

The October 29 extension event is the piece most developers already heard about. Cursor now places it after the Fireworks bucket copy and SaaS pivot:

• On October 29, using a stolen credential from exposed internal data, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension on the cache that serves Cursor's VS Code extension marketplace
• Versions named: anthropic.claude-code 2.1.312 and 2.1.313
• Anthropic did not publish these builds; Cursor states this was not an Anthropic product vulnerability
• Open VSX never had the malware
• At most 5,000 users who requested those cached versions on October 29 may have received the malicious build
• Exposure window: approximately 11 hours before removal; marketplace taken offline; attacker C2 host worked with CSP to take down

This aligns with the OpenSourceMalware analysis of 2.1.313 planting SSH persistence, while Cursor's November post adds the Fireworks root cause and confirms 2.1.312 in the same cache attack.

Critical remediation note from Cursor: if you installed or updated to those versions from the Cursor marketplace during the window, follow the steps in Cursor's October 30 security notice. Uninstalling the extension alone may not be enough—the same warning researchers gave when describing persistence outside the extension folder.

What Cursor changed after the incident

Cursor lists concrete supplier and platform moves:

• Moved all inference traffic off Fireworks, deactivated the vendor key, and cut Fireworks off shared datasets
• Rotated every exposed credential plus precautionary rotation across internal systems
• Validated other marketplace extensions, then reviewed and rebuilt the VS Code extension marketplace
• Expanded network restrictions on service providers so stolen keys cannot be used outside intended locations
• Added secret scanning across repositories and more internal data sources
• Redeployed production infrastructure and reviewed internal services before restore
• Engaged external forensics

Last attacker activity Cursor reports: November 1, blocked. The company says the incident is contained but will update the post if new customer-impacting facts appear. Questions route to security@cursor.com.

How this fits the October AI vendor breach wave

Fireworks' November 9 bulletin already widened impact to billing data and incomplete model weights for some customers, and press outlets quoted Fireworks naming Notion and Cursor among companies it was supporting. Cursor's November 13 post is the first primary-source description of what Fireworks access meant inside a coding-agent vendor.

The sequence—vendor key → training traces → SaaS → signed-adjacent distribution channel—is why explainx.ai tracks these stories beside agent breach timelines and ARTEX-style autonomous attack reporting.

It is also why Privacy Mode is not a privacy nicety. Cursor explicitly separates Privacy Mode users from the trace bucket used for vendor sharing. Teams that left training-friendly logging on for convenience traded model improvement for retained secrets in a third-party blast radius.

What developers should do this week

If you run Cursor in a team:

1. Confirm whether admins received direct incident mail—Cursor says silent inboxes mean your trace data was not in the bucket.
2. Re-read Privacy Mode defaults for repos that touch production secrets (enterprise privacy docs describe inheritance on team join).
3. If anyone installed 2.1.312 or 2.1.313 from the Cursor marketplace on October 29, run Cursor's published IOC scripts and assume host-level persistence until proven clean.
4. Rotate API keys that ever lived in agent prompts, Composer logs, or support tickets—especially cloud keys with broad IAM.
5. Map subprocessors: Cursor's trust portal lists vendors; reconcile any that still hold historical traces you did not know about.

If you fine-tune or eval on Fireworks (or similar hosts):

• Treat dataset uploads and shared buckets as credential archives, not disposable sandboxes.
• Cap key budgets and scope permissions so stolen keys cannot run unbounded inference—same playbook as Fireworks' own October notice.
• Consider whether routing choices (Cursor Router vs single-vendor fine-tunes) increase the number of parties that can see traces.

If you ship extensions or agent skills:

• Delay automatic extension updates where your editor supports cooldown settings; our Claude Code extension trojan post explains why uninstall alone failed.
• Monitor marketplace cache layers, not only upstream registries—Open VSX was clean while Cursor's cache was not.

For agent-side guardrails on trace handling and risky tool calls, see AgentBeam, the agent security platform from the explainx.ai team.

What people are asking

Did Fireworks admit exposing Cursor's key? Fireworks' public bulletins describe credential theft and October chains without narrating every downstream customer. Cursor's post is explicit that Fireworks exposed the key. For Fireworks-specific facts, anchor on Fireworks bulletins; for Cursor impact, anchor on Cursor's update.

Should I stop using Cursor? Cursor says production systems, signing keys, customer repos, and live traffic were not affected. The actionable risk clusters on historical traces without Privacy Mode, support-sent credentials, and the October 29 extension window—not on everyday typing in Privacy Mode today.

Is this the same as the Claude Code 2.1.323 observability release? No. Claude Code 2.1.323 is a product release thread. The malicious builds are 2.1.312 and 2.1.313 in Cursor's cache only.

How does this compare to npm or PyPI supply-chain attacks? Similar user exposure (developers install trusting the brand), but the entry path here is AI vendor trace storage plus internal SaaS, not a public package index typo-squat. That is closer to credential theft via agent tooling than to a lone malicious README.

Related reading

• Fireworks AI October 2026 breach: billing, weights, LLMjacking
• Trojanized Claude Code 2.1.313 SSH backdoor: confirmed facts
• Notion AI chats exposed via Fireworks
• Alex Stamos on AI breach chaining and the "dark age"
• November 2026 cyberattacks and AI incident tracker
• What is an agent harness?
• Claude Code token efficiency and session hygiene

Details reflect Cursor's November 13, 2026 post and Fireworks bulletins as of November 14, 2026.