The booby-trapped Claude Code add-on that appeared in Cursor’s marketplace on 29 October traces back to a credential leaked by Fireworks, an AI infrastructure vendor, Cursor now says. If you installed or updated that extension on a Mac or Windows PC that day, deleting it does not finish the job.
The bad releases are numbered 2.1.312 and 2.1.313. They stayed up for around 11 hours, and as many as 5,000 people fetching the cached copy may have received one. Anthropic never published them, and Open VSX, the registry behind Cursor’s marketplace, never hosted them.
The malicious code went after persistence. It reported machine details back to the attacker, then tried to append an SSH key labelled svc-telemetry to the user’s authorized keys and open a reverse tunnel. Cursor’s security notice says that tunnel only works if Cursor was launched with admin rights, which is unusual, but the key and the startup scripts landed on every machine regardless. So the fix is to delete the key, the scripts and any live tunnel, rotate whatever credentials that machine could reach, and think about rebuilding it. Cursor supplies clean-up scripts for both systems.
The chain starts earlier. Cursor’s incident update, posted on 13 November, says Fireworks let one of Cursor’s access keys escape. Using it, the attacker copied files out of a storage area the two firms shared. Inside were archived agent logs, chiefly from 2025 users who had not switched privacy mode on, and a small share of them still held working credentials (under 0.01% of customers had an API credential exposed). With them the attacker got into several of Cursor’s internal tools. What was reachable there: old test-environment code, a little customer-support correspondence, product usage numbers, contact details and digests of some agent sessions. The final step came on 29 October, when one more credential lifted from that material was used to put the fake build into the marketplace’s download cache.
Privacy-mode users were not affected. Of those who were not using it, fewer than 0.05% had traces taken, and Cursor says it has written to each one, so silence means your data was not in them. The app, its official updates and its signing keys were never reached, and the attacker’s last activity was blocked on 1 November.
Fireworks tells its side in a bulletin updated on 9 November: a cloud provider hosting its R&D machines was compromised on 23 October, and the intruder reached development machines the day after. The company says the affected data includes billing details and, for some customers, datasets and unfinished model weights, and that the evidence points to a group that resells stolen access to language models. Cursor has pulled all its inference traffic from Fireworks and promises to revise its post if anything important changes.
