---
title: 'In the News: November 14, 2026 (Extra)'
description: 'Cursor traces its breach to coding agent traces shared with a vendor, some still holding unredacted credentials.'
canonical_url: 'https://darkfactory.dev/news/2026-11-14-extra'
markdown_url: 'https://darkfactory.dev/news/2026-11-14-extra.md'
collection: news
date_published: '2026-11-14T10:08:00-05:00'
date_modified: '2026-11-14T10:08:00-05:00'
---

# In the News: November 14, 2026 (Extra)


Cursor's account of its October breach starts with coding agent traces that had been shared with a vendor and still held credentials. Read it if anyone on your team pastes keys into agent sessions. Also here: a project-level count of pull requests that maintainers flagged as AI slop, and a vendor's review of 33 public cases of agents damaging production.

## 1. Cursor says its breach began with agent traces that still held credentials

**[An update on our recent security incident](https://cursor.com/blog/security-incident-update)** · Cursor Team · Cursor blog, November 13, 2026

Cursor says an attacker obtained an access key it had issued to Fireworks, its third-party training and inference vendor, and used it to copy data from a read-only storage bucket holding coding agent traces, mostly from 2025, from sessions not in Privacy Mode. In Cursor's words, "A small number of those traces contained credentials that had not been redacted." Less than 0.01% of customers had API credentials exposed, Cursor says. From those credentials the attacker reached some of Cursor's SaaS tools, archived non-production repositories, customer support data, and some credentials users had sent to support. On October 29 the attacker used a stolen credential to place tampered copies of Anthropic's Claude Code extension (2.1.312 and 2.1.313) on the cache that serves Cursor's VS Code extension marketplace. Cursor says the build was up for about 11 hours and that at most 5,000 users who requested those cached versions may have received it.

Cursor reports that traces were exposed for fewer than 0.05% of users, that prompts and code under Privacy Mode were not affected, and that the last attacker activity it saw, on November 1, was blocked. It has moved all inference off Fireworks and rotated every credential in use across its internal systems.

**Why it matters:** An agent transcript is a data store, and what you type into it can outlive the session. Here, traces from sessions outside Privacy Mode were shared with a vendor for training, and redaction missed some keys. If a secret goes into an agent session, rotate it rather than trusting redaction further down the line.

## 2. Maintainers flagged 1,786 pull requests as AI slop and merged 11

**[An Empirical Study of Maintainer-Identified AI Slop Pull Requests in Free and Open Source Software Projects](https://arxiv.org/abs/2611.15159)** · Hugo Raskin, Xavier Devroey and Benoît Vanderose, University of Namur · arXiv preprint, November 11, 2026

The authors searched 10,000 popular, mature GitHub repositories for pull requests that maintainers had titled or labelled as slop. After removing false positives they kept 1,786 PRs from 76 repositories, covering the period up to the end of July 2026. Flagged PRs rose from 62 in January 2026 to a peak of 342 in May. Of the 1,786, 97.9% were closed unmerged, with a median time to close of 0.27 days, and 11 were merged. Two repositories, huggingface/transformers (454) and pallets/click (291), account for about 42% of the dataset. Only 13.9% of authors disclosed AI use up front.

The largest group had no stated reason: maintainers closed or flagged 439 PRs without saying why. Among stated reasons, AI policy violations (141), preposterous modifications (122) and "looks AI to me" (117) lead, with checkable ones such as insufficient verification (67) and build failures (42) further down. The authors call their counts a lower bound, since the method only finds projects that use the word, and the paper is a preprint.

**Why it matters:** If your agents open pull requests on projects you do not maintain, expect a fast close and often no explanation. The stated reasons that can be checked, a failing build, no evidence of testing, an issue already assigned to someone else, are things a harness can check before it submits.

## 3. Eon reviews 33 public cases of agents breaking production

**[What 33 public cases of AI agents breaking production have in common](https://www.eon.io/blog/ai-agent-production-incidents)** · Moshe Shelly and Julia Salem, Eon · Eon blog, November 5, 2026

Eon, which sells cloud backup and recovery, tracks public cases where an AI agent's own actions damaged live production data or systems and a first-party source says so. Of the 33 production cases, 29 are self-reported and 18 come from one coding tool's public issue tracker, which the authors say reflects where users file reports more than which agent is riskiest. In 8 cases a routine schema push, migration or test hit a database that turned out to be production; in one, a forced push dropped all 87 tables and there was no backup. At least 7 agents went ahead after a written rule or a safety mode said no. In at least three, the agent's own report was wrong, including one that called a migration "100% verified" after comparing row counts and deleted the old project without checking file storage.

On recovery, 7 cases came back fully, 4 partly and 6 not at all; the public record is silent on the other 16. Where a source says where recovered data came from, it was a copy the agent could not reach.

**Why it matters:** Rules written into a project file did not stop these agents, and recovery depended on copies they could not touch. The authors close with an audit you can run this week: for each credential your most-used agent can read, ask whether it can write to production, whether it can delete a backup, and whether anything besides the agent's own judgment stops it.

---

## Also this cycle

- **[No AI Slop: A Manifesto](https://www.slopmanifesto.com/)** · Speakers and attendees of AIE Code Summit 2026 · Introduced by Dex Horthy in the summit's closing keynote, according to Latent Space. It defines slop as putting "less effort into producing something than we ask the consumer to spend understanding it", and its signers commit to saying when an agent wrote something and to reviewing at least some subset of outputs, scaled to the stakes.