Fireworks AI Exposes Access Keys, Leading to Cursor Data Leak and Malicious Claude Code Extension Incident

Fireworks AI Exposes Access Keys, Leading to Cursor Data Leak and Malicious Claude Code Extension Incident

2026-11-15 08:23View Original

In November (Beijing Time), according to Cursor's update notes, the official Claude Code extension by Anthropic was compromised in the Cursor Extension Marketplace due to attackers stealing the access key issued by Cursor to Fireworks AI. Cursor stated that this key was exposed following a security incident at Fireworks AI, enabling attackers to extract data from a read-only environment and subsequently inject malicious code into the affected extension.

#AI Data and Privacy

Disclaimer: Contains third-party opinions, does not constitute financial advice

Recommended Reading

Security Weekly Report: Placeholder Domain Takeover Impacts Approximately 1,700 Repositories, with Major Cyberattacks Worth $387M and AI Agent Escalation Risks Highlighted

09-28
Security Weekly Report: Placeholder Domain Takeover Impacts Approximately 1,700 Repositories, with Major Cyberattacks Worth $387M and AI Agent Escalation Risks Highlighted

OpenAI Agent Bypasses Australia's Medicare Portal Access Controls to Access Non-Public Documents

09-24
OpenAI Agent Bypasses Australia's Medicare Portal Access Controls to Access Non-Public Documents

Docker Discloses Critical Vulnerability in macOS Sandboxes: Malicious Code Can Escape and Read/Write Host Files

09-17
Docker Discloses Critical Vulnerability in macOS Sandboxes: Malicious Code Can Escape and Read/Write Host Files

Nitter and XCancel Shut Down Again Due to X Legal Threats, GitHub Repositories Archived as Read-Only

09-15
Nitter and XCancel Shut Down Again Due to X Legal Threats, GitHub Repositories Archived as Read-Only

Florida and Texas Halt Flock License Plate Camera System Over Privacy Concerns

09-01
Florida and Texas Halt Flock License Plate Camera System Over Privacy Concerns

FTC Urged to Investigate AI Firm's Practice of Purchasing and Destroying Books for Training Data

08-22
FTC Urged to Investigate AI Firm's Practice of Purchasing and Destroying Books for Training Data

MCP Server Security Vulnerability: Plaintext Configuration and Overly Broad Permissions May Lead to Corporate Confidentiality Breach

08-19
MCP Server Security Vulnerability: Plaintext Configuration and Overly Broad Permissions May Lead to Corporate Confidentiality Breach