Cursor's Post-Mortem: the Backdoored Claude Code Extension Started With a Fireworks-Exposed Key

Two weeks after its first alert, Cursor has published the full post-mortem of the backdoored Claude Code extension incident — and the starting point was not the extension marketplace at all. According to Cursor’s update, the attack chain began with an access key Cursor had issued to inference vendor Fireworks. Fireworks exposed that key, an attacker used it to copy a read-only storage bucket of coding-agent training traces, and unredacted credentials inside those traces became the foothold that ended with a malicious Claude Code build sitting on the cache that served Cursor’s VS Code extension marketplace.

The chain, in Cursor’s own account

The post-mortem lays out a five-step path:

1. A Fireworks-exposed access key gave the attacker read access to a bucket Cursor shared with the vendor for model training. It held limited agent traces, mostly from 2025, from sessions not in Privacy Mode.
2. A small number of those traces contained credentials that were never redacted. Cursor says less than 0.01% of customers had API credentials exposed.
3. Starting from those credentials, the attacker reached select SaaS tools Cursor uses, pulling archived non-production source repositories, limited support data and email conversations, usage metrics, summaries of some agent conversations, and credentials users had sent to support.
4. On October 29, using a credential stolen from that exposed data, the attacker placed unauthorized copies of Anthropic.claude-code 2.1.312 and 2.1.313 directly on the marketplace cache. Anthropic did not publish them, and Open VSX — the marketplace’s upstream source — never carried the malware.
5. At most 5,000 users who requested those cached versions on October 29 potentially got the malicious build, which was live for roughly 11 hours before Cursor removed it and took the marketplace offline.

What the malware actually did

Coverage of the October disclosure filled in the payload side. As Ars Technica reported, the extension collected host details — hostname, username, OS, environment variable names, working directories, configured Git email and public IP — then tried to add an attacker-controlled SSH key, enable the local SSH service, open a reverse SSH tunnel, persist it via a macOS LaunchAgent or Windows scheduled task, and beacon status to port 8099. Coding errors meant the persistence step often failed, but host reconnaissance still went out. Because Cursor extensions run inside the IDE, an installed copy could reach local files, source code and developer tooling.

The blast radius, stated precisely

Cursor’s numbers bound what a supply-chain hit on an agent vendor can reach:

Data class	Outcome
Privacy Mode prompts and code	Not affected
Non-Privacy-Mode agent traces	Exposed for fewer than 0.05% of users, all notified directly
API credentials	Exposed for under 0.01% of customers
Production systems and live traffic	Not affected
Customer code repositories	Not affected
Other marketplace extensions	Validated authentic; store rebuilt

Containment is also dated: Cursor says the last attacker activity it observed was November 1, and it was blocked. The company’s October 30 statement had already set the remediation baseline — update to Claude Code for VS Code 2.1.314 — while stressing that the marketplace was taken down and reinstated after confirming no further risk.

What operators should actually change

Uninstalling the extension may not be enough. Cursor still asks anyone who installed or updated to 2.1.312 or 2.1.313 from its marketplace during the exposure window to follow the security-notice steps, and its own post repeats that uninstalling alone may not remove the backdoor. Update-and-move-on is the wrong response here; the safe version does not clean an already-infected host.

Treat training traces as a credential surface. The most transferable lesson in this post-mortem is that agent session data is not just telemetry — it carries secrets. Anyone operating Claude Code, Codex or a similar agent should decide now whether traces sent to vendors are redacted, whether Privacy Mode or zero-retention terms apply to their lanes, and which credentials would need rotating if a vendor bucket leaked. Treat untrusted agent output the same way you treat a suggested package name in our slopsquatting install-gate guide: assume stored context can be weaponized and gate what it can trigger.

Auto-update is a distribution channel. Ars noted that Cursor extensions auto-update by default. That convenience is exactly what converted an 11-hour cache compromise into up to 5,000 installs. The defense is not disabling updates everywhere; it is knowing which machines auto-pull which extension channels, and having an inventory so a pinning decision takes minutes, not days — the same discipline as our marketplace hygiene and pinning guide.

Vendors inherit each other’s blast radius. Cursor rotated every exposed credential, then rotated all internal credentials as a precaution, moved inference off Fireworks, expanded network restrictions so compromised keys fail outside their intended location, and added secret scanning across repositories and internal data sources. Those are the four controls worth copying for any setup where an agent vendor shares data with an inference provider — and they echo the rotation-first playbook from the OpenCode breach.

Status

Cursor believes the incident is contained and says it will contact customers directly if anything material changes. If you were notified, follow the specific key-rotation list in your email; if you were not notified and never installed the affected versions from Cursor’s marketplace, no action is indicated beyond normal extension hygiene.

The pattern, though, is now confirmed twice in one quarter: agent ecosystems are attacked through their supply chains and their stored session data, not their models. Inventory your extension sources, your trace-sharing agreements and your rotation runbook before the third one.

Load X post

Loading this post connects to X.

The original source is available above.