Cursor, the AI code editor, published an update on November 13, 2026 confirming that a breach at a model provider let attackers place a fake copy of Anthropic’s Claude Code extension in its extension marketplace. The tampered builds were live for about 11 hours on October 29, and Cursor says at most 5,000 users could have received them. If your team or a contractor uses Cursor, check this today.

What’s new

Cursor’s incident update says the attacker used an access key that Cursor had issued to Fireworks, a third-party model provider, which Fireworks had exposed. That key opened a storage bucket holding old coding agent traces, some of which contained credentials. From there the attacker reached some of Cursor’s SaaS tools and pushed the fake extension.

  • Affected builds: Anthropic.claude-code versions 2.1.312 and 2.1.313 from the Cursor marketplace, on macOS and Windows.
  • Window: roughly 2:27am to 1:35pm Pacific time on October 29.
  • Payload: it collected machine details and tried to add an SSH key labeled svc-telemetry, start a reverse tunnel and stay running after reboot.
  • Not affected, per Cursor: the Cursor app and its official updates, customer code repositories, other marketplace extensions, and prompts from users in Privacy Mode.

Who it affects

Anyone who installed or updated the Claude Code extension inside Cursor during that window. Cursor says it has emailed affected users and team admins, and that people who weren’t notified had no data in the exposed traces. Small businesses rarely run Cursor themselves, but the freelancers and agencies who build their sites and automations often do, and those machines usually hold hosting, CMS and API logins.

Our take

The risk is narrow, but the cleanup is not optional for anyone in that group. Cursor’s security notice warns that uninstalling the extension alone may not be enough, because the persistence scripts keep running. We’d do two things this week. First, ask every developer or contractor with access to your systems whether they use Cursor, and if so, have them search their SSH authorized_keys file for svc-telemetry and run Cursor’s remediation script. Second, if anyone finds that key, rotate every password, API key and session that machine could reach, from a clean device. The same rule applies to any AI coding tool: extensions run with your login, so treat them like software you install on a server.

If you’d like help reviewing which tools and contractors can reach your website, CRM or automations, our IT consulting team can audit access. We also build with AI on locked-down setups for Claude-coded websites and Claude workflows.