MediumNewsLLM-specific
Cursor confirms security breach led to malicious Claude Code extension
- Published
- Record updated
Summary
Cursor confirmed a security breach in which attackers stole an access key from Fireworks AI and used it to reach Cursor's internal systems and customer data. On October 29, the attackers used a stolen credential to publish malicious copies of Anthropic's Claude Code extension on Cursor's VS Code extension marketplace, where they stayed available for about 11 hours. The malware attempted to install persistent SSH backdoors, exposing up to 5,000 developers.
Related items
- MediumCursor Says Stolen Fireworks AI Key Led to Trojanized Claude Code Extension IncidentSame vendor · The Hacker News
- InfoThe OpenAI board member who fired Sam Altman says we still can’t trust AI CEOsSame vendor · The Verge (AI)
- InfoMeet the seven co-founders of AnthropicSame vendor · CNBC Technology
- InfoIn Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data BreachSame vendor · SecurityWeek
- InfoClaude’s Duet agent is a little neurotic and surprisingly helpfulSame vendor · The Verge (AI)