Cursor Traces Breach to Access Key Exposed by Fireworks AI

What happened

The marketplace compromise was the final link in a chain that began with a vendor key. From those tools, the attacker reached select archived, non-production Cursor source repositories, some containing business contact information.

Affected Data and Unaffected Systems Among users not using Privacy Mode, coding-agent traces were exposed for fewer than 0.05%, and Cursor said it identified and notified each affected user directly. Cursor reported in an incident update published November 13, 2026 that an attacker used a Cursor-issued access key exposed by Fireworks AI to copy historical coding-agent traces and credentials, then reach select software tools used by Cursor and distribute malicious Claude Code extension builds.

Less than 0.01% of customers had API (the interface one piece of software uses to talk to another) credentials exposed. Fireworks’ exposure of the key allowed data to be copied from a read-only bucket used for Cursor’s data sharing with the vendor.

Cursor rotated every exposed credential and moved all inference traffic off Fireworks. Its contents included limited coding-agent traces, mostly from 2025, from sessions not using Privacy Mode that Cursor was permitted to use for model training.

A small number contained unredacted credentials, providing a route into select software-as-a-service tools used by Cursor. Other accessed material included limited support data and email conversations, product-usage metrics and contact details, summaries of some coding-agent conversations, and credentials users had sent to Cursor’s support team.

The exposed traces were limited to storage used for historical offline analysis. Current customer data and live traffic, active inference requests, and Privacy Mode prompts and code were not affected.