Cursor has confirmed that a security breach allowed attackers to publish a malicious version of Anthropic's Claude Code extension through its marketplace, potentially exposing up to 5,000 developers to malware that installed persistent SSH backdoors. The disclosure came in an incident report published Friday. The attackers also reached internal systems and stole customer data, including historical AI coding-agent traces containing unredacted credentials that were later used to compromise additional services.
According to Cursor, the intrusion began when hackers obtained an access key stored at Fireworks AI, a third-party provider the company uses for AI model training and inference. The attackers used that key to copy data from a read-only storage bucket Cursor used to share information with Fireworks. That bucket held historical AI coding-agent traces, mostly from 2025, collected from users who had not enabled Privacy Mode and whose data could be used for model training.
Some of those traces contained unredacted API credentials, which the attackers used to reach more of Cursor's systems. Cursor said fewer than 0.05% of users had coding-agent traces exposed and fewer than 0.01% of customers had API credentials compromised. The stolen credentials also allowed the hackers to take data from several of the company's software-as-a-service tools.
Cursor's monitoring systems detected the unauthorized activity, prompting the company to revoke the Fireworks access key, rotate exposed credentials and investigate. Cursor temporarily disabled some internal and product services as a precaution. By then, however, the attackers had already obtained a credential that permitted them to distribute extensions through Cursor's marketplace.
On October 29, the hackers used that credential to place unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace, according to Cursor. The malicious versions, 2.1.312 and 2.1.313, were available for roughly 11 hours before being removed. Neither Anthropic's legitimate extension nor Open VSX, the marketplace Cursor uses, was compromised, the company said.
The modified extension ran malicious JavaScript that attempted to install persistent SSH backdoors, gathering system information, adding an attacker-controlled SSH key and configuring persistence for remote access. Researchers found coding errors that likely kept the backdoor from working on many Windows and macOS systems where SSH was not already enabled. Cursor says its production infrastructure, official application releases, customer code repositories, and data from Privacy Mode users were unaffected, and it has moved inference traffic away from Fireworks, rebuilt its marketplace and redeployed production infrastructure. Customers who installed or updated the affected extension during the attack are advised to follow Cursor's remediation guidance.
More cybersecurity news from TechManNews.
