Cursor kept old AI coding chats for training, and hackers found passwords inside

Cursor, the AI code editor built on Microsoft‘s open-source Visual Studio Code, says its recent breach started somewhere most users never think about: old coding sessions the company kept to train AI models. Some of those saved conversations still held passwords and API keys. The attacker used them to move deeper into Cursor’s systems until it could slip a backdoored copy of Anthropic‘s Claude Code extension into the editor’s own extension marketplace.

That chain is the part that matters for anyone who pastes a secret into an AI assistant. A key typed into a chat window does not disappear when the session ends. If the tool stores the conversation, the secret lives on in a dataset, and whoever reaches that dataset gets the key as well.

According to Cursor’s incident report, the trouble began at Fireworks AI, an outside company Cursor used for model training and inference. An attacker obtained an access key Cursor had issued to Fireworks, which Cursor says Fireworks exposed, and used it to copy a read-only storage bucket the two companies shared. Inside were coding-agent traces, mostly from 2025, from sessions where users had not switched on Privacy Mode, the setting that keeps Cursor from using your data for training. Cursor says traces were exposed for fewer than 0.05% of users, and fewer than 0.01% of customers had API credentials exposed.

Those leftover credentials opened several of the software-as-a-service tools Cursor runs on. From there, the attacker reached archived, non-production source code, customer support emails, usage metrics and contact details, summaries of some AI agent conversations, and credentials customers had once shared with Cursor’s support team, as BleepingComputer detailed. One stolen credential could publish to the cache behind Cursor’s extension marketplace.

That is how the fake Claude Code arrived. The tampered versions, numbered 2.1.312 and 2.1.313, stayed up for about 11 hours, and Cursor estimates that up to 5,000 people who requested them may have received the malicious build. It ran code that tried to plant the attacker’s SSH key and keep remote access to the developer’s computer. Cursor stresses that Anthropic did not publish the copy, that the flaw was not in Anthropic’s product, and that Open VSX, the open marketplace Cursor draws its extensions from, never carried the malware.

The report also leaves gaps. Cursor has not said how many of those 5,000 machines actually ended up with a working backdoor. Security researchers found coding errors that likely stopped it on many Windows and macOS computers where SSH was not already enabled, according to BleepingComputer, which leaves computers that already had SSH switched on the most exposed. The company also has not explained why credentials sat unredacted in data it handed to a training partner, which is the real lesson for every AI coding tool that learns from its users. Privacy Mode protected people who turned it on, but the default left everyone else’s sessions available for training.

Cursor is not the only target. Security firm Wiz counted at least nine AI developer platforms that disclosed incidents in October, a wave it calls Black October, with attackers hunting for stored keys that unlock paid AI models. Fireworks itself disclosed more than one breach, and Notion said AI chat transcripts from a small number of workspaces were exposed through it. Stolen access gets resold or burned on AI usage billed to the victim. At the cloud host Railway, BleepingComputer reported, stolen secrets were used to run up roughly $740,000 in fraudulent AI charges.

Cursor says it has moved all inference traffic off Fireworks, rotated every credential in its internal systems, rebuilt its extension marketplace and redeployed its production infrastructure. Privacy Mode users, the Cursor app and its official updates were not affected, and no release signing keys were exposed. The service works the same worldwide, so the advice applies in every market: anyone who installed or updated to Claude Code 2.1.312 or 2.1.313 from the Cursor marketplace on October 29 should follow the company’s remediation steps, and team admins should check the list of keys Cursor emailed them.

The malicious extension went live on October 29, Cursor published its first security notice on October 30, and the last attacker activity it detected was blocked on November 1. Its full incident report followed on November 13, and the company says it will contact affected customers directly if anything else turns up. For developers, the safest assumption is simpler than any patch: a password pasted into an AI chat should be treated as already written down somewhere else.

Tags: Anthropic, Cybersecurity, data breach, Claude Code, AI coding tools, Cursor