The incident in which a malicious "Claude Code" extension was distributed on the Cursor marketplace began with an access key leaked in a FireworksAI hack, The Hacker News reported on Nov. 15.

According to the report, Cursor said on Nov. 13 that an attacker obtained an access key issued by FireworksAI. The key was leaked from FireworksAI.

The attacker used the key to copy data from a read-only repository used for sharing data between Cursor and FireworksAI.

The repository included some coding agent logs from sessions that did not have "privacy mode" turned on. Most were records from 2025 and were data permitted for use in model training. The logs contained undeleted authentication credentials, which led to exposure of API credentials for some customers.

Using the credentials, the attacker accessed some software-as-a-service tools used by Cursor. With the stolen credentials, the attacker also directly uploaded the malicious Claude Code extension to the Cursor marketplace cache. The extension was distributed as if it were an official update.

Cursor said as many as 5,000 people who downloaded the version on Oct. 29 may have installed the malicious version. The malicious version was on the marketplace for about 11 hours before it was removed.

Damage from the FireworksAI hack spread to other companies. TechCrunch said driver’s licence information for thousands of Uber drivers was also stolen in the incident. Notion also confirmed last week that data was stolen in the hack.