Cursor traced its breach to a key it gave an AI vendor.

Verified at the primary: we read Cursor's post at cursor.com. It carries Friday November 13 and no time of day, which places it in Edition 091's or Edition 092's window. It was never carded, so it is carded here under its true event date, and we say plainly that it surfaced late.

Cursor published "Security incident update" on November 13, 2026, with no time of day, after about 2 weeks of investigation. The chain: Fireworks AI exposed an access key Cursor had issued it; an attacker used that key to copy data from a read only storage bucket. The bucket held mostly 2025 coding agent traces from sessions not in Privacy Mode, and some traces contained unredacted credentials. The attacker used those credentials to reach selected software as a service tools, and from there archived non production source repositories, limited customer support data and emails, product usage metrics and contact details, summaries of some coding agent conversations, and credentials users had sent to support. Separately, on October 29 the attacker used a stolen credential to place a malicious copy of the Anthropic Claude Code extension on the cache serving Cursor's VS Code extension marketplace. The tampered versions were 2.1.312 and 2.1.313, available for about 11 hours. Cursor states "Anthropic did not publish this copy, and this was not a vulnerability in Anthropic's product," and that Open VSX, the marketplace source, never carried the malware. Cursor warns that "Uninstalling the extension alone may not be enough." Scale: up to 5,000 users who requested specific cached versions on October 29 may have received the malicious build; fewer than 0.01% of customers had API credentials exposed; for users not in Privacy Mode, agent traces were exposed for fewer than 0.05% of users. Cursor says the incident "started at Fireworks," moved all inference traffic off Fireworks, deactivated the key, cut its access to shared datasets, rotated credentials, took the marketplace offline, worked with the hosting provider to take down the attacker's server, and validated all other extensions as authentic. Dates: October 29, first notice and the malicious upload; October 30, indicators of compromise, remediation steps and notification of affected users and team admins; November 1, last attacker activity, blocked. Reported elsewhere and not in Cursor's post: Fireworks dates its own intrusion to October 24 and last unauthorized platform access to October 25, and its investigation later widened to billing data and some customer model files.

1. Oct 24

   An unauthorized party reaches Fireworks AI development machines; Fireworks detects the activity that day, per later reporting.

2. Oct 29

   The attacker places a malicious copy of the Claude Code extension on the cache serving Cursor's extension marketplace. It is available about 11 hours. Cursor publishes its first notice.

3. Oct 30

   Cursor publishes indicators of compromise and remediation steps and begins notifying affected users and team administrators.

4. Nov 1

   Last attacker activity Cursor observes. It is blocked.

5. Nov 13

   Cursor publishes the post-mortem naming the Fireworks key as the origin, the credentials inside agent traces as the escalation path, and up to 5,000 users as the exposure ceiling.