What happened
Cursor reported that an attacker leveraged an access key issued to the vendor Fireworks AI, which had been exposed in a Firewalls AI breach, to copy historical coding‑agent traces and credentials from a read‑only storage bucket. The stolen data included limited coding‑agent session logs from 2025, some unredacted credentials, and support‑related information. Using these credentials, the attacker accessed select SaaS tools used by Cursor, reached archived non‑production source repositories, and uploaded malicious builds of a Claude Code VS Code extension to Cursor’s extension cache. The malicious builds were available for about 11 hours and could have been downloaded by as many as 5,000 users. Cursor’s response included rotating all exposed credentials, disabling the vendor key, moving traffic off Firewalls AI, and rebuilding its VS Code marketplace. Firewalls AI also issued its own bulletin about a separate breach of its R&D cloud environment.
On November 13, 2026, Cursor published an incident update stating that an attacker exploited an access key that Firewalls AI had issued to Cursor. The key had been exposed in a separate Firewalls AI breach and allowed the attacker to read from a read‑only bucket containing historical coding‑agent traces and limited credentials.
The stolen data comprised coding‑agent session logs from 2025 (mostly from users not employing Privacy Mode), a small number of unredacted credentials, and support‑related communications. Using these credentials, the attacker accessed select SaaS tools, reached archived non‑production source repositories, and uploaded malicious builds of a Claude Code extension to Cursor’s VS Code marketplace cache.
The malicious extension was available for roughly 11 hours, and Cursor estimates that up to 5,000 users who requested specific cached versions may have downloaded the compromised build. Cursor confirmed that the official Anthropic Claude Code product and the Open VSX marketplace were not affected.
Cursor’s response included rotating all identified credentials, deactivating the Firewalls AI vendor key, moving all traffic off Firewalls AI, and rebuilding the VS Code marketplace. The company also temporarily disabled additional internal services as a precaution, notified affected users directly, and engaged external forensics experts.
Firewalls AI issued its own security bulletin noting a separate incident on October 23‑24, 2026, where an unauthorized party accessed its R&D cloud environment. Firewalls AI revoked and replaced credentials, tightened privileges, and enhanced monitoring with Palo Alto Networks Unit 42.
Why it matters
The incident highlights the cascading risk that vendor‑issued credentials pose to downstream AI services. Even though only a tiny fraction of Cursor’s customers (<0.01%) had API credentials exposed, the breach demonstrates how a third‑party exposure can lead to the theft of historical model‑training data and the insertion of malicious code into developer tools. For developers relying on AI‑assisted coding assistants, compromised extensions could introduce supply‑chain attacks, potentially inserting malicious code into production environments. The breach also underscores the importance of strict credential hygiene, secret scanning, and network segmentation when sharing data with external AI vendors. While Cursor’s production systems and live traffic remained untouched, the episode reveals that read‑only data stores used for model training can become attack vectors if not adequately protected. Organizations using AI‑powered development tools must reassess vendor access policies, enforce credential rotation, and monitor for anomalous activity in extension marketplaces.
The breach illustrates how a single exposed vendor credential can cascade into a multi‑stage supply‑chain attack affecting downstream AI services, even when the initial exposure is limited to read‑only historical data.
For developers, malicious extensions in popular IDE marketplaces represent a direct pathway for inserting harmful code into development workflows, potentially compromising downstream production systems.
The incident underscores the need for AI companies to enforce strict secret‑scanning, credential rotation, and zero‑trust network segmentation, especially when sharing data with external vendors for model training or .
Regulatory bodies may scrutinize vendor‑access practices, as the breach demonstrates that inadequate controls can lead to data leakage and supply‑chain risks, raising questions about compliance with emerging AI security standards.
Cursor’s swift containment actions—rotating credentials, moving off the compromised vendor, and rebuilding the marketplace—provide a case study in incident response for AI‑driven developer tools, highlighting best practices and gaps that other firms can learn from.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').A public chatbot and an internal agent with write access are being assessed. Why need separate threat models?
What to watch next
Future developments may include further disclosures from Firewalls AI about the scope of its own breach, potential regulatory scrutiny of vendor credential management, and whether other AI‑powered developer platforms experience similar supply‑chain attacks. Watch for Cursor’s rollout of enhanced secret‑scanning tools, any changes to its partnership model with third‑party vendors, and broader industry moves toward zero‑trust architectures for AI data pipelines.
Further disclosures from Firewalls AI regarding the extent of its own breach and any additional compromised data.
Potential regulatory actions or guidance on vendor credential management for AI services, especially in the context of supply‑chain security.
Cursor’s implementation of new secret‑scanning and network‑restriction measures, and whether these become industry benchmarks.
Any follow‑up incidents targeting other AI‑powered developer tools or extension marketplaces, indicating a broader trend of supply‑chain attacks.
Industry adoption of zero‑trust architectures for AI data pipelines, and whether major AI platform providers announce new standards or certifications.