WORLDTECHCybersecurity DEVELOPING
Cursor confirms breach that let hackers push malicious Claude Code extension
Cursor has confirmed that a security breach allowed hackers to distribute a malicious Claude Code extension through its marketplace. According to the company, the intruders first obtained credentials from the AI infrastructure provider Fireworks AI.
How the attackers got in
Cursor says the attack began with stolen credentials belonging to Fireworks AI, an AI infrastructure provider. With those credentials, the intruders were able to place a malicious Claude Code extension in the Cursor marketplace.
The report that carries this confirmation comes from BleepingComputer. The details it contains are limited to Cursor's own confirmation, so the account of how the credentials were taken rests on the company's statement.
Open questions
- How the credentials belonging to Fireworks AI were originally obtained?
- How many users installed the malicious extension before it was removed?