MAG212 CYBER ORIGINAL ARTICLE

One Vendor Key, Three Breaches: How Fireworks’ Exposed Key Led to Cursor’s Backdoored Extension and Notion’s Exposure

November 14, 2026 · El Mostafa Ouchen

One vendor key, three breaches: Chain from an exposed Fireworks access key to Cursor's agent-trace bucket, stolen credentials, a write to the marketplace cache and a malicious extension on developer machines, with a parallel branch showing Notion AI

From the MAG212 CYBER Weekly, 14 November 2026. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was not tested by MAG212; run it only on systems you are authorised to administer.

Status: Confirmed by vendor. Cursor’s 13 November update and 29/30 October notice describe the attack [26][27]. Notion’s advisory confirms its exposure [34][35]. The Fireworks timeline comes from BleepingComputer, because Fireworks’ own bulletins were not fetched [31][32][33].

What happened

Cursor’s 13 November post traces the malicious Anthropic.claude-code 2.1.312/2.1.313 builds served on 29 October back to an access key that Cursor had issued to its inference vendor Fireworks, and that Fireworks had exposed [26]. The chain had four steps:

Why this matters

This incident shows an AI sub-processor becoming a supply-chain link: one vendor's exposed key reached a developer tool's extension cache and a productivity platform's AI transcripts. Developer machines hold source code, cloud keys and signing material, so a backdoored editor extension is a high-value foothold. (MAG212 analysis)

Chain from an exposed Fireworks access key to Cursor's agent-trace bucket, stolen credentials, a write to the marketplace cache and a malicious extension on developer machines, with a parallel branch showing Notion AI transcripts exposed through the same vendor.
Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.
  1. The key gave read access to a shared storage bucket of coding-agent traces. These were mostly from 2025, from sessions not in Privacy Mode, and permitted for training use.
  2. Some traces contained unredacted credentials. The attacker used them to reach “select SaaS tools”, which Cursor does not name.
  3. In those tools the attacker accessed:
    • archived non-production repositories
    • customer-support emails
    • product usage metrics and contact details
    • summaries of some agent conversations
    • credentials users had sent to Cursor support
  4. One stolen credential let the attacker write malicious copies directly into the cache serving Cursor’s VS Code marketplace. The upstream Open VSX “never had the malware”, and Cursor says this was not an Anthropic vulnerability [26].

Cursor’s exposure figures [26]:

  • fewer than 0.01% of customers had API credentials exposed
  • fewer than 0.05% of non-Privacy-Mode users had traces exposed
  • at most 5,000 users who requested specific cached versions on 29 October may have received the malicious build, which was live for about 11 hours

The same vendor sits behind a second disclosure. Notion said its AI chat transcripts used for Insights were exposed through Fireworks in fewer than 1% of workspaces, including anything users typed, such as API tokens [34][35]. Notion disconnected from Fireworks on 3 November. Fireworks deleted Notion’s data on 4 November. Fireworks had committed contractually to zero data retention, yet Notion found data retained on the endpoints it used [34]. Separately, Fireworks disclosed two intrusions [31]:

  • Early October: access to environment-variable secrets for a limited number of accounts. Fireworks tied this to a financially motivated LLMjacking group.
  • 23–24 October: a breach at a third-party cloud provider hosting Fireworks R&D machines. It exposed resource metadata, billing data, and incomplete copies of some customers’ model weights and datasets.

Cursor does not say which Fireworks incident exposed its key, so the link should not be asserted.

Who is affected

  • Cursor users: anyone who installed Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace on Windows or macOS between about 2:27 AM and 1:35 PM PT, 29 Oct [27].
  • Credential holders: anyone notified by Cursor about exposed credentials. Team admins received lists of specific keys to rotate. Cursor says users who received no notice were not in the exposed traces [26].
  • Notion: workspaces notified by Notion [34].
  • Fireworks: its customers, per Fireworks’ bulletins [31].

How the extension backdoor works

Per cursor’s 29 oct notice [27] and ismg [28]

  1. A 66-line loader in extension.js runs at extension start. It collects the names (not values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP, plus the global git email.
  2. It performs host and user reconnaissance.
  3. It adds an attacker SSH key with the comment svc-telemetry and enables SSH. Enabling SSH needs admin rights, so this step probably failed on most hosts.
  4. It opens a reverse SSH tunnel and beacons over HTTP POST to port 8099 at /beacon.
  5. It persists through a LaunchAgent on macOS or a scheduled task on Windows.

Anthropic shipped a clean 2.1.314, but updating does not remove an installed backdoor [28].

What defenders should look for

Defanged, from cursor [27]

  • Network: 134[.]209[.]82[.]225; reverse SSH to TCP 22; HTTP POST to port 8099, path /beacon.
  • SSH key comment: svc-telemetry in authorized_keys.
  • macOS: ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_<10hex>, ~/Library/LaunchAgents/com.apple.sysmond.plist.
  • Linux: /tmp/.stk_<10hex>; a cron @reboot entry running ~/.config/.smt.
  • Windows: %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_<10hex>, scheduled task SysMon, and sysmon.cmd in the Startup folder.
  • Processes: ssh -N -R, autossh -M 0, schtasks /create /tn SysMon.
  • VSIX hashes: per-version and per-platform SHA-256 values are on Cursor’s notice. Take them from there.

False positives: a task named “SysMon” can collide with Microsoft Sysinternals Sysmon deployments, so check what the task executes, not just its name. Note that com.apple.sysmond here is a user LaunchAgent masquerading as an Apple service.

How to investigate

  • Endpoint question (did the build run here?): check the installed extension versions. Cursor supplies a grep for macOS and a PowerShell check for Windows to find the svc-telemetry key; use them [27]. A secondary source reports cursor --list-extensions --show-versions works, but warns the command may be missing from PATH [29].
  • Credential question: handle it separately from the endpoint question. Use Cursor’s admin key lists, and review the audit logs of each named service for use of those keys.

Contain and remediate (in order)

  1. Isolate any host with the svc-telemetry key or other IOCs.
  2. Run Cursor’s remediate-macos.sh (as the user, not root) or remediate-windows.ps1 (as Administrator), or rebuild [27].
  3. Rotate every credential named in Cursor’s or Notion’s notices, plus any secret ever pasted into Notion AI or sent to Cursor support. Do this from a trusted device [26][34].
  4. Update to 2.1.314 or later.
  5. Contact security@cursor.com if you need scoping help [26].

Verify recovery

Old keys should fail in an authorised test. The svc-telemetry key and persistence should be absent. Extension versions should match your approved list.

Prevention and awareness

  • Keep secrets out of prompts, agent sessions and support tickets.
  • Ask AI vendors which sub-processors (inference providers) see your data and how retention is verified.
  • Prefer Privacy Mode or zero-retention settings.

Cursor’s own fixes are a good checklist to request from any vendor [26]:

  • moving inference off the affected provider
  • secret scanning across internal data
  • rotating all credentials
  • rebuilding its marketplace store

Command panel – VS Code CLI (source: VS Code command-line docs [30])

VSC-1 — List installed extensions with versions

  • OS / shell / tool: Windows, macOS or Linux; any shell; the code CLI (VS Code)
  • Privileges: the user who owns the editor profile
  • Purpose: list installed extensions and versions, to look for anthropic.claude-code 2.1.312 or 2.1.313. Per the docs, --list-extensions lists installed extensions and --show-versions adds versions [30].
  • Read-only or change: Read-only
  • Command:
  • How to interpret: this is the documented VS Code syntax. The malicious builds were served only from Cursor’s marketplace cache. A secondary source reports the Cursor CLI accepts the same flags (cursor …), but that is not officially documented in our sources [29]. A version match is a lead, not proof: confirm with Cursor’s VSIX hashes and IOC checks. To remove an extension, the docs give --uninstall-extension publisher.extension. Removal does not remove an installed backdoor.
  • Not tested by MAG212.
code --list-extensions --show-versions

Related on MAG212 CYBER

Sources

  1. [26] Cursor, “Security incident update”, 13 Nov 2026. link
  2. [27] Cursor, “Claude Code extension security notice”, 29 Oct, updated 30 Oct 2026. link
  3. [28] GovInfoSecurity (ISMG), “Cursor confirms Anthropic Claude Code extension compromised”, 30 Oct 2026. link
  4. [29] AiCybr, “Cursor Claude Code extension 2.1.313 marketplace compromise: response”, 30 Oct 2026. link
  5. [30] Visual Studio Code docs, “Command line interface”, Current. link
  6. [31] BleepingComputer, “Fireworks AI discloses new breach after cloud provider hack”, 10 Nov 2026. link
  7. [32] Fireworks AI, “October 2026 security incident (not fetched)”, Oct–Nov 2026. link
  8. [33] Fireworks AI, “October 2026 security incident update (not fetched)”, Nov 2026. link
  9. [34] Notion, “Security incident involving a third-party AI vendor (help centre)”, Early Nov 2026 (page undated). link
  10. [35] Notion, “Security advisory: third-party AI vendor incident”, 9 Nov 2026. link

Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.