Cursor Exits Fireworks 121 Days After Its $17.5B Valuation

Cursor, the coding app that CNBC reported supplied about half of Fireworks AI’s revenue as of last year, says it has moved all of its inference traffic off Fireworks. Cursor’s incident update, dated 13 November, says it also deactivated the key it had issued to Fireworks and cut off its access to all data sets it shared. The update came 121 days after Fireworks announced a $1.505 billion Series D at a $17.5 billion valuation on 15 July, by our arithmetic.

Fireworks said then that it had passed $1 billion in annualized revenue run rate. CNBC reported that this was five times what it had a year earlier, and quoted co-founder and chief executive Lin Qiao: “We are much more diversified right now”. The documents we read do not give Cursor’s share of Fireworks’ revenue at the time of the move.

Business Pill · Concentration Explained

An evergreen Business Engineer explainer on concentration, the general idea behind relying heavily on a single customer or position. It teaches the concept only and does not discuss Fireworks, Cursor or this incident.

What Cursor Says It Changed

Cursor’s update lists the vendor exit first under what it has done: it “Moved all inference traffic off Fireworks, deactivated the key we had issued to it, and cut off its access to all data sets we shared with it”. Among the things it says were not affected are active inference requests, which “were not exposed, and we moved all inference away from the third-party training and inference vendor as a precaution”.

Cursor traces its breach to that vendor. “It started at Fireworks”, the update says: an attacker “obtained an access key we had issued to Fireworks”, which Cursor says was exposed by Fireworks. Our piece on Cursor’s update covers that account. The Fireworks security bulletin we read on 15 November does not mention Cursor.

How Big Cursor Was at Fireworks

CNBC reported on 16 July: “As of last year, about half of Fireworks’ revenue came from AI coding startup Cursor”. It added that Cursor “has become less dependent on OpenAI and Anthropic and built a custom model named Composer”. Fireworks’ own Series D post named Cursor first among its examples: “From Cursor’s coding models to Harvey’s legal AI, companies across industries are building specialized intelligence with Fireworks”.

A run rate five times last year’s puts Fireworks at about $200 million a year earlier, by our arithmetic. CNBC’s “about half” refers to revenue last year, so the two figures do not combine cleanly, and we do not compute a dollar figure for Cursor. Other Fireworks clients CNBC named include Elastic, GitLab and MongoDB.

The 121 Days

Fireworks announced the round on 15 July, led by Atreides Management, Index Ventures and TCV, with Nvidia among the participants. On 9 October, 86 days later, it published the security bulletin its later update calls its previous one. The tampered extension Cursor describes went up on 29 October, day 106. Notion, another Fireworks customer, says it disconnected its systems from Fireworks by the morning of 3 November, day 111. Cursor’s update is dated 13 November, day 121. The day counts are our arithmetic.

At $17.5 billion against a run rate of more than $1 billion, the round valued Fireworks at no more than 17.5 times that run rate, by our arithmetic. CNBC reported that Fireworks employs around 200 people and serves 40 trillion tokens a day.

What Fireworks Has Said

Fireworks’ bulletin says a third-party cloud provider that hosted its R&D machines had a security incident on 23 October, and that on 24 October the intruder used it to reach Fireworks development machines. It says it has not detected any impact to its Inference, Training SDK and Nexus products, “which are all zero data retention (ZDR) by default”. Our piece on the second Fireworks breach covers the bulletin; our Notion piece covers that advisory.

The Structural Read

As we read it, the July round priced Fireworks after a year of fast growth: the run rate had reached five times its level a year earlier, according to CNBC, and Qiao said the company was more diversified. The documents leave open how much of the $1 billion run rate Cursor still accounted for.

As we read the two customer statements together, Notion and Cursor moved in the same order: cut the connection first, then publish the account. Notion says it disconnected by the morning of 3 November; Cursor’s update listing its move is dated 13 November. Our Notion piece sets out its timeline.

Three Implications

FOR FIREWORKS CNBC reported in July that Qiao expected head count to reach 600 by the end of 2026, and that the new money would help Fireworks obtain more GPUs and hire more technologists.

FOR CURSOR USERS Cursor says active inference requests were not exposed and that it moved all inference away from the vendor as a precaution.

FOR READERS OF THE COVERAGE Our piece on Cursor’s update covers the breach account and the extension.

The Business Engineer Lens

This story maps onto the Business Engineer framework The State of The Inference Economy.

The framework says the move to inference “is a fundamental economic restructuring that changes who makes money, how they make it, and where value concentrates in the AI economy”.

As we read it, an inference provider whose revenue concentrated in one coding app shows that structure from the supplier side. The framework was published in March 2026 and does not discuss Fireworks, Cursor or this incident.

What Is Not Established

The documents we read do not say on which day Cursor moved its traffic, how much it paid Fireworks, or whether it still uses Fireworks for model training; Cursor’s update covers inference traffic, the key and the shared data sets. CNBC’s half-of-revenue figure is for last year, and Qiao described Fireworks as more diversified by July.

Cursor’s account of how the key was exposed is its own. We did not contact Cursor or Fireworks for this piece.

The Bottom Line

Cursor, which CNBC reported was about half of Fireworks’ revenue last year, says it has moved all inference traffic off Fireworks, 121 days after the $17.5 billion round, by our arithmetic. Fireworks says it passed $1 billion in annualized revenue run rate in July, which CNBC reported was five times its level a year earlier.