Cursor Discloses Security Incident Investigation: Partial User Data Breach

On November 14 that, according to an official Cursor announcement, a recent security investigation revealed attackers obtained access keys issued to Fireworks by Cursor, copied partial tracing data for coding agents from shared storage, and used unmasked credentials to access some internal SaaS tools.

Cursor stated that attackers accessed some archived non-production source code, customer support data, and emails. Among users who did not enable privacy mode, less than 0.05% of tracing data was leaked, and less than 0.01% of customer API credentials were exposed. The company said it has directly notified affected customers and believes the incident has been contained.

Attackers also used stolen credentials on October 29 to inject a malicious version of the Claude Code extension into the Cursor marketplace cache, which could have been accessed by up to approximately 5,000 users before the malicious version was removed about 11 hours later.