Fireworks Breach Enabled Malware Distribution in Cursor Marketplace

Cursor suffered a security compromise originating from stolen credentials at Fireworks AI, a third-party AI inference provider. Attackers accessed a storage bucket containing historical AI coding traces from users who had disabled Privacy Mode, obtaining unredacted API credentials. Using these credentials, they breached Cursor’s internal systems and exposed customer data including archived source code, support records, usage metrics, and credentials previously shared with support staff. Though fewer than 0.05% of users had traces exposed and less than 0.01% had credentials compromised, the breach revealed significant supply-chain risk.

Armed with stolen marketplace distribution credentials, the attackers published two malicious versions of Anthropic’s Claude Code extension to Cursor’s VS Code marketplace on October 29. The modified extension injected JavaScript to install persistent SSH backdoors, collect system information, and enable remote access. The malware remained available for approximately 11 hours before removal. Coding errors in the backdoor likely prevented execution on many Windows and macOS systems lacking SSH capability already enabled. Up to 5,000 developers may have downloaded the compromised extension during the exposure window.

The incident exemplifies a broader campaign dubbed “Black October,” where attackers systematically compromise AI developer infrastructure to steal credentials for unauthorized inference and fraud. Related breaches affected Railway, Northflank, Lightning AI, and others. The pattern demonstrates how third-party vulnerabilities can cascade through interconnected developer ecosystems, amplifying damage across multiple platforms.