Cursor says its breach began with agent traces that still held credentials

Cursor says an attacker obtained an access key it had issued to Fireworks, its third-party training and inference vendor, and used it to copy data from a read-only storage bucket holding coding agent traces, mostly from 2025, from sessions not in Privacy Mode. In Cursor's words, "A small number of those traces contained credentials that had not been redacted." Less than 0.01% of customers had API credentials exposed, Cursor says. From those credentials the attacker reached some of Cursor's SaaS tools, archived non-production repositories, customer support data, and some credentials users had sent to support. On October 29 the attacker used a stolen credential to place tampered copies of Anthropic's Claude Code extension (2.1.312 and 2.1.313) on the cache that serves Cursor's VS Code extension marketplace. Cursor says the build was up for about 11 hours and that at most 5,000 users who requested those cached versions may have received it.

Cursor reports that traces were exposed for fewer than 0.05% of users, that prompts and code under Privacy Mode were not affected, and that the last attacker activity it saw, on November 1, was blocked. It has moved all inference off Fireworks and rotated every credential in use across its internal systems.

Why it matters: An agent transcript is a data store, and what you type into it can outlive the session. Here, traces from sessions outside Privacy Mode were shared with a vendor for training, and redaction missed some keys. If a secret goes into an agent session, rotate it rather than trusting redaction further down the line.