Cursor publishes incident report on a malicious VS Code extension

Cursor reported a security incident in which an attacker obtained an access key issued to Fireworks and used it to copy data from storage shared with Fireworks. Using a stolen credential obtained from the exposed data, the attacker placed malicious, unauthorized copies of Anthropic's Claude Code extension on the cache serving Cursor's VS Code extension marketplace on October 29. Up to 5,000 users who requested specific cached versions may have received the malicious build during approximately 11 hours. Cursor stated that the incident is contained and that the last attacker activity observed on November 1 was blocked.