Stolen Fireworks AI Key Led to Cursor Data Breach and Trojanized Claude Code Extension

Cursor says the compromise of Anthropic’s official Claude Code extension on its marketplace resulted from an access key it had issued to Fireworks AI, which was exposed in the Fireworks AI breach. Cursor says the attacker used the key to copy data from a read-only system and to trojanize the extension.