Cursor traces extension marketplace breach to a vendor credential

Check the source, version, and install time of an extension before deciding whether a device was in scope.

Cursor says its investigation traced the October 29 tampering of two Claude Code extension builds to a credential chain that began at AI inference provider Fireworks. The November 13 update adds context about the origin. The October advisory still gives teams practical checks to identify installations that may have received a tampered package. Cursor’s investigation update

What Cursor says it found

Cursor says a credential it issued to Fireworks was used to copy a limited set of historical agent traces from workflows outside Privacy Mode. Incomplete redaction left credentials in some of that material. Cursor says the attacker used the credentials to reach some of its SaaS systems, and used access gained along that chain to tamper with cached copies of an extension. Fireworks separately documented its own investigation and customer notifications. Cursor’s account of what happened comes from its findings. Fireworks investigation bulletin

Cursor estimates that up to 5,000 users could have received the altered builds. That is an estimate of potential package exposure. Cursor’s findings do not establish how many machines executed the package or were compromised.

How to check an installation

Cursor identifies its own VS Code Extension Marketplace cache as the delivery path. In its October 29 notice, the affected extension is Anthropic.claude-code, versions 2.1.312 and 2.1.313, on macOS and Windows. Cursor puts the availability window at about 2:27 a.m. to 1:35 p.m. Pacific time that day. The official Anthropic distribution and Open VSX are outside the path Cursor described. Original advisory and indicators of compromise

Use all three checks together. Confirm where the package came from, which version was installed, and when it was downloaded or updated. For managed devices, retain extension inventory and installation records for that window. Cursor’s advisory lists package indicators and separate checks for macOS and Windows. Teams that find a match can use those indicators and the advisory’s remediation instructions with their incident responders.

What teams can do with the two findings?

Treat package exposure and credentials in historical traces as two investigations. One starts with endpoint inventory and installer records. The other starts with the affected service accounts and logs. Assign someone to record which credentials a team rotated and which access logs it reviewed. Use the indicators in the October advisory to verify the endpoint findings.