Cursor Says Most Customers Were Unaffected by October Security Incident

Cursor said most customers were unaffected after malicious copies of Anthropic’s Claude Code extensions appeared in the company’s Visual Studio Code marketplace cache for about 11 hours on Oct. 29.

The copies were versions 2.1.312 and 2.1.313 and may have affected as many as 5,000 users. Cursor said it directly notified affected customers.

Cursor traced the incident to an access key it had issued to Fireworks, which Cursor said was exposed there. The attacker used the key to copy a limited set of coding-agent traces and access some of Cursor’s software-as-a-service tools, including archived source code and support data. The attacker later used stolen credentials to place the malicious extension copies in the marketplace cache.

Cursor said it rotated credentials, migrated inference traffic and rebuilt its extension marketplace. The company considered the incident under control as of Nov. 1. It said data from users in Privacy Mode, customer code repositories, production systems and official app updates were not affected.