A stolen credential allowed attackers to turn Cursor’s extension delivery system into a route onto developers’ computers, Cursor has confirmed. In its November 14 report, BleepingComputer described the company’s newly disclosed account of a breach that exposed customer information and enabled malicious Claude Code packages to reach as many as 5,000 users.
The immediate concern is for developers who installed or automatically updated anthropic.claude-code versions 2.1.312 or 2.1.313 from Cursor’s marketplace on October 29, 2026. The packages attempted to establish lasting remote access, and updating or uninstalling the extension does not remove the unauthorized keys and startup files they may have left elsewhere on a device.
Cursor estimates that up to 5,000 users who requested those versions during the exposure window may have received the altered builds. Microsoft’s October 30 analysis cites Cursor’s availability window of approximately 2:27 AM to 1:35 PM Pacific Daylight Time on October 29—about 11 hours before removal.
From training records to extension delivery
Cursor, an AI-assisted editor based on Microsoft’s open-source Visual Studio Code, traced the intrusion to an access key held at Fireworks AI, its third-party provider for model training and inference. BleepingComputer reported that Cursor published its fuller incident account on Friday.
The key gave attackers read access to a storage bucket used to share information with Fireworks. They copied historical coding-agent traces—records of agents’ activity—mostly dating from 2025. These belonged to users whose data was eligible for model training because they had not enabled Privacy Mode.
Some traces included unredacted API credentials, which let the attackers move into other Cursor systems. Cursor puts the exposure at fewer than 0.05% of users for agent traces and fewer than 0.01% of customers for compromised API credentials.
Data taken from Cursor’s hosted business tools included archived, non-production source repositories, some with business contact information; limited support records and email conversations; usage metrics and customer contact details; summaries of some agent conversations; and credentials customers had previously given the support team.
Cursor said monitoring detected the unauthorized activity. It revoked the Fireworks key, rotated exposed credentials and investigated further access, temporarily disabling some internal and product services. But the attackers already held another credential that let them write unauthorized extension packages directly into the cache serving Cursor’s marketplace.
The company says production infrastructure, official application releases, customer code repositories, and Privacy Mode users’ code and prompts were unaffected. Its response included moving all inference traffic away from Fireworks, rebuilding the extension marketplace and precautionarily redeploying production infrastructure.
The distribution route matters when assessing exposure. Open VSX, the marketplace Cursor uses, and Anthropic’s legitimate extension were not compromised. Microsoft confirmed that neither Visual Studio Marketplace nor npm’s @anthropic-ai/claude-code distributed the malicious packages. Anthropic told Microsoft that its systems were uncompromised and that it had not produced the altered package; Microsoft’s evidence pointed to an incident confined to Cursor’s marketplace.
What happened when the extension loaded
Microsoft Threat Intelligence found that injected JavaScript executed ahead of the extension’s normal code. Through Node.js interfaces and built-in operating-system tools, it could gather information, change files and run commands without fetching another executable. The extension continued to work while the injected code hid command output and silently handled errors.
Its first task was reconnaissance: hostname, username, operating system, processor architecture, home and working directories, and the global Git email address. It also selected up to 40 environment-variable names matching terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP. A delayed callback attempted to report the host details and those variable names, rather than their stored secret values.
The remote-access setup used two different keys. The loader searched the user’s SSH authorization file for svc-telemetry; if absent, it added an embedded Ed25519 public key. SSH, or Secure Shell, is a protocol for authenticated remote access, so that entry could admit whoever possessed the matching private key, subject to local configuration.
A separate embedded private key authenticated an outbound connection under the remote account tunnel. Its temporary filename began .stk_, followed by ten hexadecimal characters derived from the hostname and home directory, and SSH loaded it using -i. The connection requested reverse forwarding, creating a route back through the outbound tunnel to the workstation’s SSH service. Startup mechanisms then attempted to keep that connection running, before the delayed reconnaissance report.
These were attempted capabilities, with success dependent on device privileges, SSH settings and the attacker’s server configuration. BleepingComputer reported researchers’ findings that coding errors likely blocked working backdoors on many Windows and macOS devices without SSH already enabled. Microsoft nevertheless found that authorization keys and startup artifacts could be written even when the tunnel failed.
BleepingComputer places the breach within the AI-development attacks Wiz calls “Black October,” which affected Railway, Northflank, Lightning AI, OpenCode and Warp, involved credential abuse for unauthorized inference and sometimes attempted model distillation, included approximately $740,000 in fraudulent Railway AI charges and unauthorized OpenCode usage, and encompassed October Fireworks breaches exposing keys and tokens or development machines through a compromised cloud provider, with AI transcripts from a small number of Notion workspaces also exposed.
Preserve evidence, then remove persistent access
Microsoft advises organizations to identify affected installations and compare installation records with device, network, file, process and authentication logs. Isolate devices showing execution of the loader or installation of a backdoor. Before cleanup, retain the extension package, changed authorization files, generated keys, scripts and startup configuration.
Useful investigation indicators include the configured SSH and HTTP destination 134.209.82[.]225 and reporting endpoint hxxp://134[.]209[.]82[.]225:8099/beacon. Microsoft identifies these SHA-256 hashes:
- JavaScript entry point:
ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. This identifies the script, not the extension package. - Decoded tunnel private-key file:
7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278.
For unauthorized access keys, inspect ~/.ssh/authorized_keys on macOS and Linux, and %USERPROFILE%\.ssh\authorized_keys plus C:\ProgramData\ssh\administrators_authorized_keys, where present, on Windows. Match the suspected svc-telemetry entry to fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk before deleting that specific key. Keep legitimate keys and remote-development settings; absence of the marker alone does not clear a device.
After evidence collection, remove the malicious extension and confirmed persistence:
- macOS: unload and delete
~/Library/LaunchAgents/com.apple.sysmond.plist, a per-user startup configuration, along with~/.config/.smtand~/.config/.smtk. - Linux: delete the malicious user-crontab
@rebootentry pointing to~/.config/.smt, preserving other entries, and remove that script and~/.config/.smtk. - Windows: remove the malicious
SysMonscheduled task, Startup-foldersysmon.cmdfallback,%USERPROFILE%\.config\smt.cmdand%USERPROFILE%\.config\smtk.
Inspect startup actions before removal: a familiar filename alone is insufficient. Stop confirmed malicious SSH and retry processes and, after collection, remove temporary identities matching .stk_[0-9a-f]{10}.
Microsoft provides Defender detections and hunting queries covering connections, file artifacts, Windows scheduled tasks and macOS startup changes. Query matches are investigation leads requiring correlation; file hashes are not populated in every event.
Cursor also offers platform-specific checks and remediation scripts, which Microsoft recommends reviewing with their execution requirements before use. Investigators should examine activity after extension loading for accepted SSH keys, tunnels, local sessions, commands and file access. Where credential exposure is indicated or device trust cannot be restored, rotate credentials and revoke sessions from a known-clean device; rebuild when the investigation requires it.
Neither removing the extension nor Cursor’s reported server takedown clears existing device artifacts. Verify that they do not return after login or restart, and apply Microsoft’s recommended Cursor controls: restrict extensions to approved publishers and use an installation cooldown to delay newly published releases.
