Cursor reveals how a leaked key put a backdoored Claude Code in front of 5,000 users
What Happened
According to the Cursor post-mortem, the incident began when an attacker obtained a Cursor-issued access key that Fireworks AI, a vendor that provided inference services to Cursor, had exposed. The attacker used the key to copy data from a shared read-only storage bucket. The attacker then planted malicious copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, on the cache that serves Cursor's Visual Studio Code extension marketplace. The poisoned copies were placed on 29 October 2026 and remained available for approximately 11 hours before removal.
The mechanism of the malicious build was described in technical analysis by Cyber Security News, which reported that the copies carried an SSH backdoor. The Cursor blog itself does not use the term SSH backdoor, and the characterisation of the mechanism should therefore be attributed to Cyber Security News rather than to Cursor. The distinction is a narrow one, but it is the kind of precision that the public record of a security incident requires.
The Scale of Exposure
Cursor stated that at most approximately 5,000 users who requested the cached versions of the extension potentially received the malicious build during the 11-hour window. The company framed the figure as an upper bound on potential distribution. It did not report a number of confirmed infections, and no such number should be inferred from the figure. A user who downloaded the cached version during the window may have received the malicious build; whether any given download led to compromise is a separate question that the published record does not answer.
Two further figures in the post-mortem describe a different part of the incident and must not be combined with the distribution figure. Fewer than 0.05 percent of users had coding-agent traces exposed, and fewer than 0.01 percent of users had API credentials exposed. These percentages describe data exposure arising from the compromised storage bucket, not the population that received the malicious extension. Conflating the two would misstate both the reach of the extension and the reach of the data exposure.
What Was Not Affected
The post-mortem is explicit about several points that limit the scope of the incident. Anthropic did not publish the malicious copy; the extension was a copy of Anthropic's software, planted by the attacker, and Anthropic bears no responsibility for its distribution. Cursor's own product was not vulnerable in the sense that the flaw lay in the exposed vendor key and the poisoned cache, not in a defect in the editor itself. Open VSX, the open extension registry, never hosted the malware, which reached users only through the cache serving Cursor's marketplace.
The last attacker activity was recorded on 1 November 2026 and was blocked. Cursor stated that the incident is believed to be contained, a formulation that reflects the limits of what an investigation can establish with certainty rather than an absolute guarantee.
The Response
Cursor has moved all inference work off Fireworks AI and has cut the vendor's access to its data. The decision removes the specific trust relationship that the attacker exploited: a vendor holding a Cursor-issued key with access to shared storage. Whether the move is permanent was not stated in the material reviewed, and the company did not disclose further details of its revised vendor arrangements.
The incident also illustrates a structural risk in the modern software supply chain. A code editor that serves extensions through a cache inherits the security posture of every party that can write to that cache or to the credentials that guard it. In this case, the weakest point was neither the editor nor the extension author, but a vendor credential that was exposed outside both organisations. The 11-hour window between planting and removal further shows how quickly a poisoned artifact can reach users once it enters a distribution path that is designed for speed.
Why It Matters
For users of AI-assisted coding tools, the incident is a reminder that the extensions installed from a marketplace are only as trustworthy as the pipeline that delivers them. A backdoored coding assistant is a particularly consequential form of compromise, because such tools routinely handle source code, credentials and terminal access. The potential distribution of approximately 5,000 users is small relative to Cursor's user base, but the nature of the payload makes the incident significant beyond its size.
For the industry, the post-mortem is a case study in the limits of vendor trust. Fireworks AI exposed a key that belonged to Cursor, and the exposure gave an attacker a path into Cursor's distribution infrastructure. The lesson is not that vendors should never be trusted, but that credentials issued to vendors require the same controls as credentials held internally, including rotation, scope limitation and monitoring for anomalous use.
What Happens Next
Cursor has stated that the incident is believed contained and that its inference work has moved away from Fireworks AI. Users who installed or updated the Claude Code extension through Cursor's marketplace around 29 October 2026 should verify that they are running a legitimate version and should treat any credential that may have been present in an exposed trace as requiring rotation. The company has not disclosed whether it will publish further technical detail, and the public record, for the present, rests on the post-mortem and the independent technical analysis that followed it.
Source: Cursor blog, 13 November 2026; Cyber Security News, 14 November 2026.
