Cursor has released the results of its investigation into the Claude Code plugin poisoning incident, revealing that the attack originated from a leaked access key by AI service provider Fireworks. Hackers used this key to obtain the Coding Agent execution records of users who did not enable privacy mode in 2025, and then used the un-anonymized API keys within to infiltrate internal services, stealing non-production code, customer service emails, and user credentials.
On October 29, hackers used stolen credentials to tamper with the extension store cache and released versions 2.1.312 and 2.1.313 of Claude Code, which contained an SSH backdoor. The malicious versions existed for approximately 11 hours, and up to 5,000 users may have downloaded them. The official versions of Open VSX and Anthropic were unaffected.
This breach affected less than 0.05% of users, with less than 0.01% of users having their API credentials exposed. Sessions with privacy mode enabled, customer code repositories, and production systems were unaffected. Cursor intercepted the hacking activity on November 1st, stopped using Fireworks to process inference requests, revoked its access permissions, and rotated its internal credentials.
