Home / Incidents / Data breach
Cursor breach via Fireworks key led to malicious Claude Code extension builds
Cursor says an attacker used a key it had issued to Fireworks AI to read coding-agent traces, then used credentials found in them to plant tampered Claude Code extension versions in its marketplace cache on 29 October. Up to 5,000 users may have downloaded them; some customer API credentials, support records and archived source code were also exposed.
- Organisation
- Cursor (Anysphere)
- Disclosed
- 13 November 2026
- Affected
- Not stated
- Data
- Coding-agent traces, embedded credentials, some customer API credentials, support records, archived source code; malware pushed to developer machines
- Attacker
- Unknown
- Severity
- major
- Region
- Global
- Source
- Cyber Security News ↗
Cite this
Nuffield Consulting, “Cursor breach via Fireworks key led to malicious Claude Code extension builds”, The Daily Tech Wire outage & breach log, 13 Nov 2026. https://techwire.nuffieldconsulting.com/incidents/2026-11-13-cursor-breach/ (retrieved 15 Nov 2026).
This entry summarises public reporting. Please also cite the original source: Cyber Security News, https://cybersecuritynews.com/cursor-data-breach/.
Related incidents
- 11 Nov 2026Baltic SMS provider left 125M messages exposedCSCTelecom · breach · Unknown · 125M records
- 9 Nov 2026Nitori warns 37.62m customer records may have leakedNitori · breach · Unknown · 37.6M records
- 9 Nov 2026Frontline Education breach total rises to over 3 millionFrontline Education · breach · Unknown · 3.1M records
- 7 Nov 2026Crédit Mutuel Arkéa hit via a service providerCrédit Mutuel Arkéa · breach · Unknown
- 6 Nov 2026Chainalysis says credentials and live tokens for all customers were exposedChainalysis · breach · Unknown