📰 Key Summary

Cursor has published the findings of its investigation into the earlier Claude Code plugin poisoning incident. After two weeks, the source of the attack points to its AI provider, Fireworks. Cursor says Fireworks leaked an access key granted by Cursor, which the attackers used to copy historical Coding Agent run logs stored in shared storage. These logs mainly came from 2025 user sessions that didn’t have privacy mode turned on, and they were originally meant for model training. Some of the API keys in those logs hadn’t been sanitized, so the attackers used them to break into some of the internal software services Cursor uses. They obtained archived non-production code, customer support emails, product usage data, some AI conversation summaries, and credentials that users had previously submitted to customer support. On October 29, the attackers used the stolen internal credentials to tamper with the extension marketplace cache, serving users Claude Code versions 2.1.312 and 2.1.313 with an SSH backdoor planted in them. The malicious versions were live for about 11 hours, and up to 5,000 users may have downloaded them. Upstream Open VSX wasn’t tampered with, and the official Anthropic releases weren’t affected. Cursor points out that the leaked run logs involved less than 0.05% of users, and less than 0.01% of users had API credentials exposed. Sessions with privacy mode on, customer code repositories, and production systems weren’t affected. The last attacker activity was spotted on November 1, and it was successfully intercepted at that point. Cursor has now notified affected users, stopped using Fireworks for inference requests entirely, revoked its data access, rotated internal credentials, and redeployed its production infrastructure.

💬 JudyAI Lab Take

Cursor’s investigation shows that a supply chain attack on an extension marketplace actually started with one access key leaked by an upstream AI provider, Fireworks. From the key leak to the malicious versions going live, every link in the chain connects to the next, and it puts the risk of data used for model training right in the spotlight.

This case offers a few takeaways for AI builders. First, what the attackers copied were historical Coding Agent run logs originally meant for model training. Some of the API keys in those logs weren’t sanitized, which let the attack extend from a third party all the way into Cursor’s internal services, and finally tamper with the extension marketplace cache and put Claude Code versions 2.1.312 and 2.1.313 with an SSH backdoor into users’ hands. Second, Cursor says in the original post that sessions with privacy mode on, customer code repositories, and production systems weren’t affected, which shows that data isolation design really did prevent bigger losses. Third, the risk isn’t only in your own systems. When you hand inference or training off to an external provider, their key management becomes your attack surface too. Afterward, Cursor stopped using Fireworks for inference requests entirely and rotated its internal credentials, which is a pretty high price to pay.

My suggestion: take stock this week of where your Agent run logs and conversation histories are stored, whether any API keys are sitting in them in plaintext, and sanitize them before they get written.

📅 Source Info

🔗 Further Reading