What changed
Cursor’s update says an attacker obtained an access key Cursor had issued to its vendor Fireworks and copied a storage bucket of coding-agent traces, mostly from 2025 and from sessions not in Privacy Mode. Some traces held unredacted credentials (under 0.01% of customers had API credentials exposed), which the attacker used to reach some of Cursor’s SaaS tools. On October 29 the attacker placed tampered copies of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, on the cache behind Cursor’s VS Code extension marketplace; at most 5,000 users may have received them during roughly 11 hours. Anthropic did not publish the copy and it was not a flaw in Claude Code. Cursor says the last attacker activity was on November 1, the incident is contained, inference has moved off Fireworks and credentials have been rotated.
Who it affects
Cursor users who installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor’s marketplace on October 29; users without Privacy Mode whose traces were in the exposed data (Cursor says it notified each one); and anyone who sent credentials to Cursor support. Cursor says Privacy Mode users’ prompts and code, its production systems, the Cursor app and official updates were not affected.
What to do
If you installed either tampered version, follow the steps in Cursor’s October 30 security notice; Cursor says uninstalling alone may not be enough. Rotate any credentials you ever pasted to Cursor support or that your admin was told were exposed.