Security AlertHigh
Cursor breach exposed developer accounts and a malicious extension
Nov 14, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Cursor says hackers stole credentials from Fireworks AI, accessed internal systems, and pushed a malicious Claude Code extension. Up to 5,000 developers may have been exposed.
Key points
- Cursor linked the breach to credentials stolen from Fireworks AI.
- Hackers used Cursor’s marketplace to publish malicious Claude Code extensions on October 29.
- The attack exposed historical coding-agent traces and some API credentials.
- Cursor says fewer than 0.05% of users and fewer than 0.01% of customers were affected.
Why it matters
Developers and small teams using AI coding tools should check their extensions and rotate any exposed secrets. A marketplace compromise can spread malicious code quickly. Even limited exposure can create follow-on risk for connected services.
Who’s affected: Cursor users, developers, and linked SaaS accounts
What to do
- Review installed Cursor extensions.
- Rotate exposed API keys and credentials.
- Watch for suspicious SSH access or account activity.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.