Cursor Confirms Breach Behind Malicious Claude Code Extension

Cursor has confirmed a security breach that let attackers distribute malicious versions of Anthropic's Claude Code extension through its Visual Studio Code (VS Code) extension marketplace on October 29. Up to 5,000 developers who requested affected builds during an approximately 11-hour window may have received malware attempting to install persistent SSH backdoors. Attackers began by stealing a key from AI infrastructure provider Fireworks AI, then extracted unredacted credentials from historical coding-agent traces to reach internal systems. Developers and organisations in Malaysia using Cursor can report confirmed security incidents to Cyber999 (MyCERT).

Key Facts

How Did Attackers Breach Cursor and Compromise the Marketplace?

Attackers obtained an access key stored on third-party AI provider Fireworks AI and used it to copy historical AI coding-agent traces from a read-only Cursor storage bucket. Unredacted API credentials inside those traces granted access to internal SaaS tools, yielding a credential used to publish malicious Claude Code extensions on October 29.

Cursor stated that the exposed bucket held traces mostly from 2025, collected from users who had not enabled Privacy Mode and whose data could be used for model training. Although Cursor's monitoring systems detected the unauthorised activity and prompted the company to revoke the Fireworks key and rotate exposed credentials, the attackers had already obtained a credential capable of distributing extensions.

"On October 29, using a stolen credential from the exposed data from our internal system, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace," Cursor explained.

The malicious builds, versions 2.1.312 and 2.1.313, remained available for approximately 11 hours before removal. They executed modified JavaScript that gathered system information, installed an attacker-controlled SSH key, attempted to enable SSH access, and set up persistence mechanisms, though security researchers found coding errors likely prevented the backdoor from functioning on many Windows and macOS computers without SSH already enabled.

Anthropic's legitimate Claude Code extension and the Open VSX marketplace used by Cursor were not compromised during the October 29 attack.

What Data and Systems Were Affected in the Incident?

Fewer than 0.05% of Cursor users had historical coding-agent traces exposed, and fewer than 0.01% of customers had API credentials compromised. Using those keys, attackers stole data from several internal software-as-a-service tools, while up to 5,000 developers may have received the poisoned Claude Code builds during the approximately 11-hour window.

According to Cursor, data taken from its software-as-a-service tools included:

• Archived, non-production Cursor source code repositories, some containing business contact details.
• Limited customer support records and email conversations.
• Product usage metrics and customer contact information.
• Summaries of some AI coding-agent conversations.
• Credentials previously shared by customers with Cursor's support team.

Cursor stated that its production infrastructure, official application releases, customer code repositories, and code or prompts from users with Privacy Mode enabled were unaffected. As precautions, the company moved all inference traffic away from Fireworks AI, revoked and rotated exposed credentials, rebuilt its extension marketplace, and redeployed production infrastructure.

Code, prompts, and repositories belonging to Cursor users who had Privacy Mode enabled were not affected by the data exposure.

How Does This Incident Connect to Wider AI Platform Attacks?

Cursor's breach occurred alongside a broader wave of October attacks against AI developer platforms, termed "Black October" by cybersecurity firm Wiz. These campaigns targeted development infrastructure to steal authentication secrets providing AI model access, resulting in unauthorised AI inference charges, exposed transcripts, and suspected model distillation attempts across multiple providers.

According to the report, affected organisations in the wider wave include Railway, Northflank, Lightning AI, OpenCode, Warp, Fireworks AI, and Notion. At Railway, stolen customer authentication secrets were used to generate approximately $740,000 in fraudulent AI charges, while OpenCode disclosed exposed API keys and unauthorised AI usage. Fireworks AI reported multiple October breaches involving exposed API keys and tokens as well as development machine access through a compromised third-party cloud provider, impacting customers including Notion, which disclosed exposed AI chat transcripts from a small number of workspaces.

Fireworks AI disclosed multiple security breaches in October that also affected other customers beyond Cursor, including Notion.

What Should You Do?

• Check whether you installed or updated Anthropic's Claude Code extension in Cursor during the October 29 exposure window (versions 2.1.312 or 2.1.313) and follow Cursor's official remediation guidance; no specific patched extension version number is listed in the report, as Cursor removed the malicious builds and rebuilt its marketplace.
• Inspect affected developer systems for unauthorised SSH keys, newly enabled SSH access, or unexpected persistence mechanisms, particularly on machines where SSH was already active.
• Revoke and rotate any API keys or secrets that may have appeared in 2025 AI coding-agent traces or been shared with Cursor's support team.
• Enable Privacy Mode in Cursor so code and prompts are excluded from model training data collection.
• Remain alert for phishing targeting exposed business contact or support email addresses; affected organisations and developers in Malaysia can report confirmed security incidents to Cyber999 (MyCERT).

Common Questions

Were official Cursor releases or Privacy Mode users compromised?

No. Cursor stated that its production infrastructure, official application releases, and customer code repositories were not affected. Code and prompts belonging to users who had enabled Privacy Mode were also unaffected, because the exposed storage bucket only held traces eligible for model training.

Did the malicious Claude Code extension affect Open VSX or Anthropic?

No. Attackers placed the tampered versions 2.1.312 and 2.1.313 directly onto the cache serving Cursor's VS Code extension marketplace using a stolen internal credential. Cursor confirmed that neither Anthropic's legitimate Claude Code extension nor the Open VSX marketplace was compromised.

Why did the SSH backdoor fail on some developer machines?

Security researchers analysing the malicious JavaScript inside versions 2.1.312 and 2.1.313 found coding errors in the payload. Those bugs likely prevented the backdoor from working on many Windows and macOS systems where SSH access was not already enabled beforehand.

Sources and Methodology

This dispatch is based solely on the BleepingComputer report published on November 14, 2026. No external advisories, vendor pages, or independent technical documents were reviewed or verified for this summary.