Newshot Cursor Discloses Security Incident Investigation Results: Malicious Claude Code Extension Affected Up to 5,000 Users
On October 29 local time, Cursor published a notice stating that a malicious and unauthorized copy of the Anthropic Claude Code extension had appeared in the Cursor VS Code extension marketplace.
On November 13 local time, after a comprehensive investigation over the past two weeks, Cursor disclosed the results of its investigation into the security incident. The company said the vast majority of customers were unaffected, with at most 5,000 users impacted; affected customers have been contacted directly one by one and informed of the details relevant to them.
According to reports, if users were using Privacy Mode, their prompts and code were unaffected; among users not using Privacy Mode, fewer than 0.05% had their coding agent trace data leaked. Cursor has identified these users and has notified each of them directly. If you have not received a notice, your data is not among these trace records.
The company said it is learning from this experience to further improve Cursor's security.
IT之家 summarizes the brief sequence of events:
- Fireworks key leak: Attackers used leaked Fireworks access keys to steal some data from Cursor's shared storage bucket, and used a small number of unredacted credentials within it (affecting fewer than 0.01% of customers) to compromise some of Cursor's SaaS tools, accessing some non-production code repositories, customer support data, and some user credentials.
- Detection and emergency response: After detecting the anomaly, Cursor immediately disabled the leaked keys, rotated credentials, and cut off unauthorized access, while precautionarily shutting down some internal and product services, which have been gradually restored after security was confirmed.
- Malicious extension injection incident: On October 29, attackers used stolen internal credentials to inject a tampered version of the Anthropic Claude Code extension into the Cursor extension marketplace (unrelated to Anthropic or Open VSX). The malicious version remained live for about 11 hours and affected at most 5,000 users. Cursor subsequently removed the extension, temporarily took the marketplace offline, and worked with the cloud service provider to shut down the attackers' servers.
- Customer notification and remediation guidance: On October 30, Cursor published a security advisory and notified affected parties, assisting with the revocation and rotation of leaked keys. Users who installed the malicious version (Anthropic.claude-code 2.1.312 or 2.1.313) need to follow the advisory's guidance to check their systems; uninstalling the extension alone will not fully remove the risk.
- Incident under control: After blocking the last attack on November 1, Cursor confirmed the incident was under control and will continue to strengthen monitoring and protection, and will notify affected customers directly if there are new developments.
Related Articles
- Official fix underway: Claude Code reportedly writes passwords into project files, 2,539 real credentials found on GitHub
- Anthropic reveals what scientists use Claude for: mostly data analysis and writing
- Claude Code adjusts game development restrictions: existing games no longer rejected, direct replication prohibited
- Anthropic engineer warns: the more accurate AI becomes, the easier it is for humans to lose independent thinking; the more dependent they are, the harder it is to stay vigilant
- Anthropic steps in: Claude Opus 5.5 will no longer help you "AI-replicate games"
- 11 hours affected about 5,000 developers: malicious Claude Code plugin appeared in AI coding tool Cursor's official marketplace