A security breach at Cursor, an AI code editor, began when an attacker obtained a compromised API key that Cursor had issued to its inference provider, Fireworks AI. This key, exposed on Fireworks' side, allowed the attacker to access a read-only storage repository containing limited training data and some unredacted credentials. The attacker then used these credentials to access Cursor's internal tools, archived source code repositories, and user support data. Subsequently, the attacker planted malicious versions of the Claude Code extension in Cursor's VS Code extension store, which were downloaded by up to 5,000 users before being removed. AI
IMPACT This supply chain attack highlights vulnerabilities in AI tool integrations and the potential for compromised credentials to impact end-users.
RANK_REASON Security incident affecting an AI-adjacent developer tool.
Read on dev.to — Anthropic tag →
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
