Cursor says one key leaked at Fireworks opened its old coding-agent traces and led to the Claude Code backdoor

Remember the backdoored Claude Code extension that sat in Cursor's marketplace for 11 hours? Cursor has now traced it back to the start, and the first domino wasn't even in its own building.

What happened

Cursor had issued an access key to Fireworks, the AI vendor it shared data with for model training and inference. Cursor says Fireworks exposed that key. An attacker used it to copy a read-only storage bucket of coding-agent traces, mostly from 2025, from sessions that weren't in Privacy Mode. Buried in a small number of those traces were credentials nobody had redacted.

The damage

Fewer than 0.01% of customers had API credentials exposed, and traces leaked for fewer than 0.05% of users. That was enough. Starting from those keys, the attacker reached some of Cursor's SaaS tools, then archived non-production source code, support emails, usage metrics, summaries of some agent chats and credentials users had sent to support. One stolen credential let them drop fake Claude Code builds 2.1.312 and 2.1.313 onto the cache behind Cursor's extension marketplace. Up to 5,000 users may have pulled the backdoor before it was removed about 11 hours later.

How it was caught, and what happened next

Cursor says the incident is contained, with the last attacker activity blocked on 1 November. It moved all inference off Fireworks, rotated every internal credential, rebuilt the marketplace and added secret scanning. It says production systems, app updates and release signing keys were never touched.