Cursor updates on the security incident progress: the vast majority of users were not affected, and affected users have been directly notified

Cursor has released the latest progress regarding recent security incidents. After a comprehensive investigation lasting two weeks, the incident originated from attackers obtaining an access key issued to Fireworks. This key was leaked by Fireworks, allowing the attackers to replicate limited programming agent link tracking data and further infiltrate some SaaS tools, accessing certain archived source code, support data, and more.

The attackers subsequently utilized the stolen credentials to distribute a malicious copy of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) in the Cursor VS Code extension marketplace cache on October 29, potentially affecting up to approximately 5,000 users. This malicious version was removed about 11 hours later. Cursor emphasized that the vast majority of customers were not affected, and affected customers have been notified directly. User data in privacy mode is secure, and production systems, official application updates, and customer code repositories were not impacted. The company has rotated credentials, migrated inference traffic, rebuilt the extension marketplace, and believes the incident was contained as of November 1.