Today for AI
HOT RADAR
toolsHEAT 11.6°

AI CURATED HOT STORY · 11/14/2026

Cursor Discloses Supply Chain Attack Affecting Up to 5,000 Users

1 reports archived1 independent sourcesupdated 11/14/2026, 18:52:39
Synthesis & Latest Updates
1 Sources Cross-Validated

Cursor released its investigation into an October security incident in which attackers used leaked Fireworks keys to steal data from a shared storage bucket, then leveraged internal credentials to inject a tampered Claude Code extension into the Cursor marketplace. The malicious build stayed live for about 11 hours and affected up to 5,000 users; fewer than 0.05% of non-privacy-mode users had agent trace data exposed, and Cursor has notified affected customers and rotated credentials.

LATEST/Cursor released its investigation into an October security incident in which attackers used leaked Fireworks keys to steal data from a shared storage bucket, then leveraged internal credentials to inject a tampered Claude Code extension into the Cursor marketplace. The malicious build stayed live for about 11 hours and affected up to 5,000 users; fewer than 0.05% of non-privacy-mode users had agent trace data exposed, and Cursor has notified affected customers and rotated credentials.

Hourly heat curve

3 fully observed hours
Now
11.6
Peak
12.019:00
24h change
–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first
  1. IT之家 · 智能时代T2·72 pts

    Cursor Discloses Supply Chain Attack Affecting Up to 5,000 Users

    • The attack chain began with leaked Fireworks access keys, spreading to Cursor's shared storage bucket and internal SaaS tools
    • The tampered Claude Code extension (2.1.312/2.1.313) was live for about 11 hours, and uninstalling alone does not fully remove the risk
    • Privacy-mode users' prompts and code were unaffected; under 0.05% of non-privacy-mode users had agent trace data exposed