Stolen Fireworks AI Key Led to Cursor Data Breach and Trojanized Claude Code Extension

Cursor disclosed a data breach caused by a stolen Fireworks AI access key, leading to exposure of limited user data and internal source code. The attacker used stolen credentials to distribute trojanized versions of Anthropic's Claude Code extension via Cursor's marketplace, affecting up to 5,000 users.