Cursor hack truth revealed: Fireworks leaked keys, hackers breached plugin store through AI training records

Beating AI News Flash: Cursor has released the findings of its investigation into the previous poisoning incident involving the Claude Code plugin. After a two-week investigation, the company discovered that the source of the attack was unexpectedly its AI service provider, Fireworks.

According to Cursor, Fireworks leaked an access key granted by Cursor. Hackers used this key to copy historical Coding Agent run records that Cursor had stored in shared storage space. These data mainly came from user sessions in 2025 that had not enabled privacy mode and were originally intended for model training.

More seriously, some API keys in the records had not been desensitized. Hackers used these credentials to further breach some internal software services used by Cursor, obtaining archived non-production code, customer service emails, product usage data, some AI conversation summaries, and credentials that users had previously submitted to customer service.

On October 29, hackers again used credentials stolen from inside Cursor to directly tamper with the extension store's cache and provide users with Claude Code versions 2.1.312 and 2.1.313 implanted with an SSH backdoor. The malicious versions existed for about 11 hours, and up to 5,000 users may have downloaded them. The upstream plugin marketplace Open VSX was not tampered with, and Anthropic's official version was also unaffected.

Cursor disclosed that the leaked Coding Agent run records involved less than 0.05% of users, of whom less than 0.01% had API credentials exposed. Sessions with privacy mode enabled, customer code repositories, and production systems were not affected by this attack.

Cursor stated that the last discovery of hacker activity was on November 1, when it was successfully intercepted. The company has now notified affected users, completely stopped using Fireworks to process inference requests, revoked its data access permissions, rotated internal credentials, and redeployed production infrastructure.