What happened
Cursor. According to Cursor, the attacker used a key issued for Fireworks that leaked from the provider to exfiltrate storage data: coding agent session traces, primarily from 2025, from sessions outside Privacy Mode. Some contained unmasked credentials. Using these, the attacker accessed select SaaS tools, archived repositories, customer support data, and emails. On October 29, the attacker placed malicious copies of the Claude Code extension in the Cursor extension marketplace cache. Cursor notes this was not a vulnerability in the Anthropic product.
Notion. Notion reported on November 9 that data stolen from Fireworks may have included Notion AI chat transcripts used in the Insights feature – affecting fewer than 1% of workspaces. The company severed ties with Fireworks on November 3 and disabled Insights during the investigation.
Fireworks. The provider reports that on October 24, an unauthorized party reached its developer machines following an incident at an external cloud provider. For a subset of accounts, secrets, datasets, and incomplete model weights were exposed. Fireworks links the incident to a threat group reselling unauthorized access to language models (LLMjacking).
Key findings
- Malicious versions of the Anthropic.claude-code extension (2.1.312 and 2.1.313) were available for approximately 11 hours; according to Cursor, up to 5,000 users may have downloaded them.
- API keys were exposed for fewer than 0.01% of Cursor customers; agent traces affected fewer than 0.05% of users.
- According to Cursor, Privacy Mode data, production systems, signed application releases, and customer repositories were not impacted.
- Notion recommends treating affected data as compromised and rotating passwords and keys pasted into Notion AI.
- Cursor migrated inference workloads away from Fireworks, rotated leaked credentials, and proactively rotated all active internal credentials.