Brecha de Cursor: la clave de Fireworks abrió la cadena

The Cursor breach began with a Fireworks key. The full report, published on November 13 after two weeks of investigation, stated that an attacker obtained an access key that Cursor had issued for Fireworks AI, its inference and training provider. The October 29 alert had already revealed a fake Claude Code extension circulating in Cursor's store.

Now, the source details where the key came from, what data was copied with it, and how far the intruder went. This incident, moving from a store to a supply chain between AI firms, shows how a single mistake can have widespread consequences. The attacker copied data from a read-only storage depot Cursor used to share information with Fireworks.

The depot held limited traces of coding agents, mostly from 2025, of sessions without Privacy Mode, which the company could use for model training. Most of this data was harmless; a small portion contained unredacted credentials. On the provider side, Fireworks reported a cloud provider incident a few days earlier on October 23, detected the next day with forensic help from Unit 42 (Palo Alto Networks).

Unit 42 noted an uncomfortable detail: Fireworks' bulletin did not mention Cursor, so the connection between the two incidents is still attributed to Cursor. The stolen credentials opened the second door, allowing the attacker to access several Cursor Software as a Service (SaaS) tools, archived code repositories outside production, some with commercial contact information, limited support data and conversations, product usage metrics with contact details, conversation summaries with agents, and credentials sent to support.

Cursor detailed how its monitoring systems detected unauthorized activity, and the response cut access at multiple layers: it deactivated the provider's key, revoked and rotated credentials, searched for other entries, and shut down internal and product services, more than the evidence required. Several functions failed during the shutdown, but they were restored one by one.

On October 29, using a stolen credential with these internal data, the attacker planted altered fake Claude Code extension copies, versions 2.1.312 and 2.1.313, directly in the cache served by the VS Code extension store. Cursor did not publish this copy, nor did its product have the flaw, and Open VSX, the open-source source of the store, never hosted the malicious program.

The window was short and unpleasant: around 11 hours, with up to 5,000 users requesting those versions during that time. The next day, the October 30 alert brought indicators of compromise, remediation steps, and scripts for team review, and the company warned users and administrators via the application and email. Administrators with exposed credentials received the exact list of keys to rotate, and Cursor asked issuing services to revoke them.

The practical warning remains in effect: uninstalling the altered extension alone may not be enough. The report's figures narrow the damage to less than 0.01% of clients with exposed API credentials in the traces, and less than 0.05% of users with non-Privacy Mode sessions. Cursor identified each user in that group and directly notified them; those who received no notification did not appear in the copied material.

Client code repositories, production systems, and official version signature keys remained untouched. The attacker's last activity was recorded on November 1 and was blocked. The company declared the incident contained and executed the cut with the provider in three moves: it moved all inference outside Fireworks, deactivated the issued key, and closed Fireworks' access to each data set shared.

Within its own house, it rotated all credentials, widened network restrictions between providers, added secret scanning in repositories, and deployed its production infrastructure, contracting external forensic experts. For program creators using AI assistants in the region, the uncomfortable lesson is not the editor but the habit of pasting API keys in chats and agent sessions, which then get saved as traces for model training.

The report's concrete tasks are clear: check if any of the two altered versions were installed since the October 29 store, and rotate any keys that have passed through a session without Privacy Mode.