Cursor says it has moved all inference traffic off Fireworks AI after tracing its breach to an access key it had issued to the inference vendor. “It started at Fireworks”, Cursor wrote in an incident update dated 13 November, adding: “The key was exposed by Fireworks”.
Cursor says the same attack put a tampered copy of Anthropic’s Claude Code extension in its marketplace on 29 October, a build it says at most 5,000 users potentially received. The update came 35 days after Fireworks published its first bulletin on its own breach, on 9 October, and 15 days after Cursor’s first notice, by our arithmetic.
Business Pill · Least privilege
An evergreen Business Engineer explainer on least privilege: giving an AI agent only the access its task needs. It teaches the general idea only and does not discuss Cursor or this incident.
The key insight: As we read Cursor’s account, the breach turned on data Cursor had shared with a vendor for model training rather than on its production systems: a read-only bucket of coding agent traces, some holding unredacted credentials, which Cursor says was copied with a key it had issued to Fireworks AI.
According to Cursor, the attacker used the key “to copy data from a read-only storage bucket we used to share data with them”. That bucket held “limited coding agent traces, mostly from 2025, from sessions not in Privacy Mode, which we were permitted to use for model training”.
Some traces held credentials that had not been redacted, and Cursor says “less than 0.01% of customers had API credentials exposed”. From those credentials, it says, the attacker reached “select SaaS tools used by Cursor”, then archived non-production source code repositories, limited support data and some credentials users had sent to its support team.
On 29 October, Cursor says, the attacker used a stolen credential to place “malicious, unauthorized copies of Anthropic’s Claude Code extension directly on the cache used to serve the Cursor VS Code extension marketplace”. Cursor says “Anthropic did not publish this copy, and this was not a vulnerability in Anthropic’s product”. Our 29 October piece covered that notice.
Days after Fireworks AI’s first security bulletin (9 October 2026) for each dated step in the two companies’ accounts; day counts are our arithmetic.
What Fireworks Has Said
Fireworks’ latest bulletin, updated on 9 November, does not mention Cursor. It says “A third-party cloud provider that hosted Fireworks R&D machines experienced a security incident on October 23”, and that on 24 October the intruder used it “to reach Fireworks development machines”.
The bulletin says Fireworks found impacts to account and billing information and, “For a limited set of accounts”, to “secrets, datasets, and incomplete models”. Our piece on the second Fireworks breach covers the earlier reporting.
What Cursor Has Changed
Cursor says it “Moved all inference traffic off Fireworks, deactivated the key we had issued to it, and cut off its access to all data sets we shared with it”. It says the last attacker activity it saw was on 1 November, three days after the extension went up, by our arithmetic, and that it believes the incident is contained.
Cursor puts the exposure of coding agent traces at “fewer than 0.05%” of users not using Privacy Mode, fewer than 5 in every 10,000, by our arithmetic. Its update says: “This incident involved data we stored and shared, credentials we issued, and systems we operate”.
The chain runs through vendor keys, the same route our piece on stolen AI keys tracked this week.
The Structural Read
As we read the update, the business change is the vendor exit: Cursor says it moved all inference traffic off Fireworks and cut its access to every data set it shared, 35 days after Fireworks first disclosed its own breach, by our arithmetic.
As we read the two companies’ documents side by side, they have not yet given one shared account: Cursor names the Fireworks key, while the Fireworks bulletin of 9 November does not mention Cursor.
Cursor, An update on our recent security incident, 13 November 2026
“This incident involved data we stored and shared, credentials we issued, and systems we operate.”
Three Implications
FOR CURSOR USERS Cursor says it has contacted each affected customer directly, and that traces were exposed for fewer than 0.05% of users not using Privacy Mode.
FOR AI VENDORS Cursor says it deactivated the key it had issued to Fireworks and cut off Fireworks’ access to all data sets it shared with it.
FOR ANYONE RUNNING THE EXTENSION Cursor asks users who installed versions 2.1.312 or 2.1.313 from its marketplace during the window to follow its security notice; it says uninstalling alone may not be enough.
The framework opens: “The surface, not the model, governs autonomy.”
As we read it, Cursor’s account places this breach in the surface around the model, in vendor keys, shared training data and an extension cache; the framework was published in July 2026 and does not discuss this incident.
Upper bounds from Cursor’s 13 November update, restated per 10,000 (our arithmetic).
What Is Not Established
Neither company says when the key was taken, so it is not established whether the 24 October intrusion at Fireworks is the point where it was exposed. Cursor’s account of the cause is its own; Fireworks has not addressed it in its bulletin.
Fireworks and Cursor were not contacted for this piece.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
Cursor now traces the 29 October tampered Claude Code extension, which it says reached at most 5,000 users, to an access key it had issued to Fireworks AI, 35 days after Fireworks first disclosed its own breach, by our arithmetic.
A note on sourcing. The account of the breach, the key and the exposure figures come from Cursor’s incident update of 13 November 2026 and its notice of 29 October; the Fireworks dates come from Fireworks AI’s security bulletin, last updated 9 November 2026, read in full on 14 November. Day counts and the per-10,000 figures are our arithmetic. Neither company was contacted for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
