AiPost

  Cursor has finally explained how its October security incident really happened — and the trail leads outside Cursor itself. In an update published on November 13, 2026, the AI coding company said the breach began at Fireworks AI, one of its inference vendors, after an access key it had issued to Fireworks was exposed there. What followed was a chain reaction: stolen coding agent traces, harvested credentials, and a tampered extension slipped into the cache that serves Cursor's marketplace. Here is what happened, what was affected, and what you should do now. How the breach unfolded According to Cursor, the attacker used the exposed Fireworks key to copy coding agent traces from a read-only storage bucket Cursor used to share data with Fireworks. Most of the traces dated from 2025 and came from sessions outside Privacy Mode. A small number of those traces contained unredacted credentials. Cursor says fewer than 0.05% of users had traces exposed, and fewer than 0.01% of customers h...