Cursor says Fireworks AI breach led to malicious extension

Two October breaches at AI infrastructure startup Fireworks AI have now hit at least three of its customers. On Friday, November 13, Cursor said attackers used an access key stolen from Fireworks to break into its systems and publish a malicious version of Anthropic's Claude Code extension, BleepingComputer reported. The same week, Uber said drivers' license data had been stolen and Notion said some AI chat transcripts were exposed.bleepingcomputer.com

Cursor's compromised marketplace

According to Cursor's incident report, attackers used the Fireworks key to copy a storage bucket the two companies shared. The bucket held historical AI coding-agent traces, mostly from 2025, and some contained unredacted API credentials. The attackers used those credentials to reach other Cursor systems, BleepingComputer reported. On October 29, they placed unauthorized copies of the Claude Code extension, versions 2.1.312 and 2.1.313, on the cache that serves Cursor's extension marketplace. The copies stayed up for about 11 hours and tried to install persistent SSH backdoors. Cursor estimates up to 5,000 developers may have received them. Fewer than 0.05% of users had coding-agent traces exposed. Cursor has since moved all inference traffic away from Fireworks.bleepingcomputer.com

Uber drivers and Notion chats

Uber told TechCrunch that its driver notices relate to "a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data." State filings reviewed by TechCrunch list 2,567 affected people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island. Counts for Illinois and California were not yet available. Uber's California notice says the provider alerted it on October 9 and that Uber cut off its data connections with the provider. The notice also says Uber has found no misuse of the data so far and is offering free credit monitoring, according to Reuters.techcrunch.com+1

Notion said a dataset Fireworks handed over on November 8 included Notion AI chat transcripts used for its Insights feature. For most affected workspaces, the transcripts could not be linked to specific users, according to its advisory. Fewer than 1% of workspaces were affected. Notion disconnected from Fireworks on November 3 and has turned off Insights, TechCrunch reported.techcrunch.com+1

Two separate intrusions

Fireworks' November 9 update describes two incidents. The first, first disclosed in early October, is tied to "LLMjacking," where criminals steal access to AI models and resell it, Forbes reported. In the second, an attacker used a breached third-party cloud provider on October 24 to reach Fireworks development machines. Fireworks says that intrusion exposed billing information and, for certain customers, "a subset of incomplete model weights and datasets," according to the company's bulletin. Fireworks is working with Palo Alto Networks' Unit 42 ↘ 0.13% on the forensic investigation, Gizmodo reported.fireworks.ai+2

Fireworks has more than 10,000 customers. A spokesperson said the company is "actively working with our customers to manage the incident, including Notion, Cursor and others," Insurance Journal reported, citing Bloomberg. The breaches are part of a wider wave of attacks on AI developer platforms that security firm Wiz has dubbed "Black October," according to BleepingComputer.insurancejournal.com+1