Cursor says a remote attacker turned a vendor key into poisoned extension updates, with no local access required. Users who requested cached copies of Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace could receive the malicious build.
At most 5,000 users were in that path.
The company says the build stayed live for approximately 11 hours before removal, and uninstalling alone may not clean an affected machine. That figure compares with credential exposure for less than 0.01% of customers from coding agent traces, and trace exposure for fewer than 0.05% of users, all from sessions not in Privacy Mode and mostly from 2025, according to Cursor.
Cursor says the chain started with an access key it had issued to Fireworks, exposed by Fireworks, then used to copy a read-only bucket holding agent traces permitted for training. From unredacted credentials in those traces, the attacker reached select SaaS tools, archived non-production repositories, support emails, usage metrics and summaries of agent conversations, the company said.
That account diverges in one detail from outside reporting. Anthropic says its own systems were not breached, while a security firm studying the attack says the extension went out through Anthropic's official account on Cursor. Cursor says Anthropic did not publish the copy and Open VSX never hosted the malware, which leaves the Cursor cache as the sole distribution point named so far.
What the numbers do not show is how many of the 5,000 pulled and executed the payload, or how many exposed API keys were abused before rotation. Cursor says it moved all inference off Fireworks, rotated exposed and then all internal credentials, redeployed production and rebuilt the marketplace, with last attacker activity blocked on November 1. A full count of executed installs would change the read from exposure to impact.
With production systems, signing keys and customer repositories untouched according to Cursor, will enterprises treat this as a vendor key failure rather than a code supply failure?
