Overview
Cursor, the AI-powered coding platform, has confirmed that a trojanized version of Anthropic’s official Claude Code extension was distributed through its extension marketplace on October 29, 2026, as the downstream consequence of a third-party vendor breach. The root cause: a stolen API key issued to Fireworks AI, an inference provider, exposed data in a shared read-only storage bucket that contained unredacted credentials from coding agent session traces. Attackers leveraged those credentials to pivot into Cursor’s internal systems and poison its extension distribution cache — a textbook multi-stage AI supply chain attack.
Technical Analysis
The attack unfolded in two distinct phases:
Phase 1 — Vendor key theft and data exfiltration: An attacker obtained an access key Cursor had issued to Fireworks AI following a breach of that provider. Using the key against a read-only storage bucket shared for model training purposes, the attacker exfiltrated coding agent session traces dating to 2025. Critically, these traces contained credentials that had not been scrubbed — exposing API secrets belonging to fewer than 0.01% of Cursor’s customer base. The attacker used these to pivot into select Cursor SaaS tooling, accessing archived source code repositories, customer support data, usage metrics, and credentials users had submitted via support channels.
Phase 2 — Extension cache poisoning: Armed with an internal credential harvested during Phase 1, the attacker directly modified the cache layer serving Cursor’s extension marketplace. Trojanized builds of Anthropic’s Claude Code extension (versions 2.1.312 and 2.1.313) were substituted for the legitimate update. The malicious build attempted to install a persistent SSH backdoor on host systems. The window of exposure lasted approximately 11 hours, during which up to 5,000 users may have downloaded the compromised extension.
Cursor responded by taking the extension marketplace offline, deactivating Fireworks AI’s key, rotating internal credentials, and working with the cloud hosting provider to take down the attacker’s C2 server.
Framework Mapping
- AML.T0010 (AI Supply Chain Compromise) and AML.T0115 (Publish Poisoned AI Artifacts): The attacker directly injected a malicious extension into an AI coding tool’s distribution pipeline.
- AML.T0083 / AML.T0098 (Credentials from / Harvesting AI Agent Configuration): Unredacted credentials in coding agent traces were the pivotal enabler.
- AML.T0057 (LLM Data Leakage): Session data shared with a third-party vendor leaked sensitive customer credentials.
- LLM05 (Supply Chain Vulnerabilities): The attack exploited trust in a third-party inference vendor and the extension update mechanism.
- LLM06 (Sensitive Information Disclosure): Credentials embedded in agent traces constituted direct sensitive data exposure.
Impact Assessment
Up to 5,000 Cursor users are potentially affected by the backdoored extension. Any developer who installed versions 2.1.312 or 2.1.313 on October 29, 2026 may have a persistent SSH backdoor on their system. The broader credential exposure from agent traces — while affecting fewer than 0.01% of customers — enabled lateral movement into internal Cursor infrastructure, including source code and customer support records. The incident also disrupted Cursor platform features during the containment period.
Mitigation & Recommendations
- Uninstall and audit: Remove Claude Code versions 2.1.312/2.1.313 immediately and scan for unauthorised SSH keys or persistent backdoor artifacts.
- Rotate all vendor-shared credentials: Any API keys or secrets shared with inference or data partners should be treated as compromised and rotated.
- Enable Privacy Mode: Cursor users should activate Privacy Mode to prevent session traces from being shared with third parties for training.
- Implement credential scrubbing: AI platforms must enforce automated redaction of secrets in agent session traces before those traces enter any shared storage.
- Apply least-privilege to vendor keys: Third-party inference providers should receive scoped, time-limited keys with no access beyond what is operationally necessary.