{"id":4284,"date":"2026-11-14T10:57:16","date_gmt":"2026-11-14T18:57:16","guid":{"rendered":"https:\/\/cyber.mag212.com\/cursor-extension-backdoor-fireworks-vendor-key-notion\/"},"modified":"2026-11-14T10:57:16","modified_gmt":"2026-11-14T18:57:16","slug":"cursor-extension-backdoor-fireworks-vendor-key-notion","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/cursor-extension-backdoor-fireworks-vendor-key-notion\/","title":{"rendered":"One Vendor Key, Three Breaches: How Fireworks&#8217; Exposed Key Led to Cursor&#8217;s Backdoored Extension and Notion&#8217;s Exposure"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><em>From the <a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026<\/a>. Status labels: confirmed by vendor, reported by researchers, or unverified. Every command below is copied from official documentation and was <strong>not tested by MAG212<\/strong>; run it only on systems you are authorised to administer.<\/em><\/p>\n\n\n\n<p class=\"m2-status wp-block-paragraph\"><strong>Status:<\/strong> <strong>Confirmed by vendor.<\/strong> Cursor&#8217;s 13 November update and 29\/30 October notice describe the attack <sup><a href=\"#src-26\">[26]<\/a><\/sup><sup><a href=\"#src-27\">[27]<\/a><\/sup>. Notion&#8217;s advisory confirms its exposure <sup><a href=\"#src-34\">[34]<\/a><\/sup><sup><a href=\"#src-35\">[35]<\/a><\/sup>. The Fireworks timeline comes from BleepingComputer, because Fireworks&#8217; own bulletins were not fetched <sup><a href=\"#src-31\">[31]<\/a><\/sup><sup><a href=\"#src-32\">[32]<\/a><\/sup><sup><a href=\"#src-33\">[33]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cursor&#8217;s 13 November post traces the malicious Anthropic.claude-code 2.1.312\/2.1.313 builds served on 29 October back to an access key that Cursor had issued to its inference vendor <strong>Fireworks<\/strong>, and that Fireworks had exposed <sup><a href=\"#src-26\">[26]<\/a><\/sup>. The chain had four steps:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why this matters<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This incident shows an AI sub-processor becoming a supply-chain link: one vendor&#x27;s exposed key reached a developer tool&#x27;s extension cache and a productivity platform&#x27;s AI transcripts. Developer machines hold source code, cloud keys and signing material, so a backdoored editor extension is a high-value foothold. <em>(MAG212 analysis)<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/cursor-extension-backdoor-fireworks-vendor-key-notion-diagram.png\"><img decoding=\"async\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/cursor-extension-backdoor-fireworks-vendor-key-notion-diagram.png\" alt=\"Chain from an exposed Fireworks access key to Cursor&#x27;s agent-trace bucket, stolen credentials, a write to the marketplace cache and a malicious extension on developer machines, with a parallel branch showing Notion AI transcripts exposed through the same vendor.\"\/><\/a><figcaption class=\"wp-element-caption\">Diagram: MAG212 CYBER. Solid red = observed or vendor-confirmed; dashed amber = reported or unverified; green = recommended control.<\/figcaption><\/figure>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The key gave read access to a shared storage bucket of coding-agent traces. These were mostly from 2025, from sessions not in Privacy Mode, and permitted for training use.<\/li>\n\n<li>Some traces contained <strong>unredacted credentials<\/strong>. The attacker used them to reach &#8220;select SaaS tools&#8221;, which Cursor does not name.<\/li>\n\n<li>In those tools the attacker accessed:<ul><li>archived non-production repositories<\/li><li>customer-support emails<\/li><li>product usage metrics and contact details<\/li><li>summaries of some agent conversations<\/li><li><strong>credentials users had sent to Cursor support<\/strong><\/li><\/ul><\/li>\n\n<li>One stolen credential let the attacker write malicious copies <strong>directly into the cache serving Cursor&#8217;s VS Code marketplace<\/strong>. The upstream Open VSX &#8220;never had the malware&#8221;, and Cursor says this was not an Anthropic vulnerability <sup><a href=\"#src-26\">[26]<\/a><\/sup>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Cursor&#8217;s exposure figures <sup><a href=\"#src-26\">[26]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>fewer than <strong>0.01%<\/strong> of customers had API credentials exposed<\/li>\n\n<li>fewer than <strong>0.05%<\/strong> of non-Privacy-Mode users had traces exposed<\/li>\n\n<li>at most <strong>5,000<\/strong> users who requested specific cached versions on 29 October may have received the malicious build, which was live for about <strong>11 hours<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The same vendor sits behind a second disclosure. Notion said its AI chat transcripts used for Insights were exposed through Fireworks in <strong>fewer than 1% of workspaces<\/strong>, including anything users typed, such as API tokens <sup><a href=\"#src-34\">[34]<\/a><\/sup><sup><a href=\"#src-35\">[35]<\/a><\/sup>. Notion disconnected from Fireworks on 3 November. Fireworks deleted Notion&#8217;s data on 4 November. Fireworks had committed contractually to zero data retention, yet Notion found data retained on the endpoints it used <sup><a href=\"#src-34\">[34]<\/a><\/sup>. Separately, Fireworks disclosed two intrusions <sup><a href=\"#src-31\">[31]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Early October:<\/strong> access to environment-variable secrets for a limited number of accounts. Fireworks tied this to a financially motivated LLMjacking group.<\/li>\n\n<li><strong>23\u201324 October:<\/strong> a breach at a third-party cloud provider hosting Fireworks R&amp;D machines. It exposed resource metadata, billing data, and incomplete copies of some customers&#8217; model weights and datasets.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cursor does not say which Fireworks incident exposed its key<\/strong>, so the link should not be asserted.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who is affected<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cursor users:<\/strong> anyone who installed Anthropic.claude-code <strong>2.1.312 or 2.1.313 from the Cursor marketplace<\/strong> on Windows or macOS between about <strong>2:27 AM and 1:35 PM PT, 29 Oct<\/strong> <sup><a href=\"#src-27\">[27]<\/a><\/sup>.<\/li>\n\n<li><strong>Credential holders:<\/strong> anyone notified by Cursor about exposed credentials. Team admins received lists of specific keys to rotate. Cursor says users who received no notice were not in the exposed traces <sup><a href=\"#src-26\">[26]<\/a><\/sup>.<\/li>\n\n<li><strong>Notion:<\/strong> workspaces notified by Notion <sup><a href=\"#src-34\">[34]<\/a><\/sup>.<\/li>\n\n<li><strong>Fireworks:<\/strong> its customers, per Fireworks&#8217; bulletins <sup><a href=\"#src-31\">[31]<\/a><\/sup>.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How the extension backdoor works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Per cursor&#8217;s 29 oct notice <sup><a href=\"#src-27\">[27]<\/a><\/sup> and ismg <sup><a href=\"#src-28\">[28]<\/a><\/sup><\/em><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>A 66-line loader in <code>extension.js<\/code> runs at extension start. It collects the <em>names<\/em> (not values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP, plus the global git email.<\/li>\n\n<li>It performs host and user reconnaissance.<\/li>\n\n<li>It adds an attacker SSH key with the comment <code>svc-telemetry<\/code> and enables SSH. Enabling SSH needs admin rights, so this step probably failed on most hosts.<\/li>\n\n<li>It opens a reverse SSH tunnel and beacons over HTTP POST to port 8099 at <code>\/beacon<\/code>.<\/li>\n\n<li>It persists through a LaunchAgent on macOS or a scheduled task on Windows.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Anthropic shipped a clean 2.1.314, but <strong>updating does not remove an installed backdoor<\/strong> <sup><a href=\"#src-28\">[28]<\/a><\/sup>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What defenders should look for<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Defanged, from cursor <sup><a href=\"#src-27\">[27]<\/a><\/sup><\/em><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Network:<\/strong> <code>134[.]209[.]82[.]225<\/code>; reverse SSH to TCP 22; HTTP POST to port 8099, path <code>\/beacon<\/code>.<\/li>\n\n<li><strong>SSH key comment:<\/strong> <code>svc-telemetry<\/code> in <code>authorized_keys<\/code>.<\/li>\n\n<li><strong>macOS:<\/strong> <code>~\/.config\/.smt<\/code>, <code>~\/.config\/.smtk<\/code>, <code>$TMPDIR\/.stk_&lt;10hex&gt;<\/code>, <code>~\/Library\/LaunchAgents\/com.apple.sysmond.plist<\/code>.<\/li>\n\n<li><strong>Linux:<\/strong> <code>\/tmp\/.stk_&lt;10hex&gt;<\/code>; a cron <code>@reboot<\/code> entry running <code>~\/.config\/.smt<\/code>.<\/li>\n\n<li><strong>Windows:<\/strong> <code>%USERPROFILE%\\.config\\smt.cmd<\/code>, <code>%USERPROFILE%\\.config\\smtk<\/code>, <code>%TEMP%\\.stk_&lt;10hex&gt;<\/code>, scheduled task <code>SysMon<\/code>, and <code>sysmon.cmd<\/code> in the Startup folder.<\/li>\n\n<li><strong>Processes:<\/strong> <code>ssh -N -R<\/code>, <code>autossh -M 0<\/code>, <code>schtasks \/create \/tn SysMon<\/code>.<\/li>\n\n<li><strong>VSIX hashes:<\/strong> per-version and per-platform SHA-256 values are on Cursor&#8217;s notice. Take them from there.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>False positives:<\/strong> a task named &#8220;SysMon&#8221; can collide with Microsoft Sysinternals Sysmon deployments, so check what the task executes, not just its name. Note that <code>com.apple.sysmond<\/code> here is a <strong>user<\/strong> LaunchAgent masquerading as an Apple service.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to investigate<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Endpoint question (did the build run here?):<\/strong> check the installed extension versions. Cursor supplies a <code>grep<\/code> for macOS and a PowerShell check for Windows to find the <code>svc-telemetry<\/code> key; use them <sup><a href=\"#src-27\">[27]<\/a><\/sup>. A secondary source reports <code>cursor --list-extensions --show-versions<\/code> works, but warns the command may be missing from PATH <sup><a href=\"#src-29\">[29]<\/a><\/sup>.<\/li>\n\n<li><strong>Credential question:<\/strong> handle it separately from the endpoint question. Use Cursor&#8217;s admin key lists, and review the audit logs of each named service for use of those keys.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Contain and remediate (in order)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Isolate any host with the <code>svc-telemetry<\/code> key or other IOCs.<\/li>\n\n<li>Run Cursor&#8217;s <code>remediate-macos.sh<\/code> (as the user, <strong>not<\/strong> root) or <code>remediate-windows.ps1<\/code> (as Administrator), or rebuild <sup><a href=\"#src-27\">[27]<\/a><\/sup>.<\/li>\n\n<li>Rotate every credential named in Cursor&#8217;s or Notion&#8217;s notices, plus any secret ever pasted into Notion AI or sent to Cursor support. Do this <strong>from a trusted device<\/strong> <sup><a href=\"#src-26\">[26]<\/a><\/sup><sup><a href=\"#src-34\">[34]<\/a><\/sup>.<\/li>\n\n<li>Update to 2.1.314 or later.<\/li>\n\n<li>Contact security@cursor.com if you need scoping help <sup><a href=\"#src-26\">[26]<\/a><\/sup>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Verify recovery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Old keys should fail in an authorised test. The <code>svc-telemetry<\/code> key and persistence should be absent. Extension versions should match your approved list.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prevention and awareness<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep secrets out of prompts, agent sessions and support tickets.<\/li>\n\n<li>Ask AI vendors which sub-processors (inference providers) see your data and how retention is verified.<\/li>\n\n<li>Prefer Privacy Mode or zero-retention settings.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Cursor&#8217;s own fixes are a good checklist to request from any vendor <sup><a href=\"#src-26\">[26]<\/a><\/sup>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>moving inference off the affected provider<\/li>\n\n<li>secret scanning across internal data<\/li>\n\n<li>rotating all credentials<\/li>\n\n<li>rebuilding its marketplace store<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Command panel &#8211; VS Code CLI (source: VS Code command-line docs <sup><a href=\"#src-30\">[30]<\/a><\/sup>)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>VSC-1 \u2014 List installed extensions with versions<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OS \/ shell \/ tool: Windows, macOS or Linux; any shell; the <code>code<\/code> CLI (VS Code)<\/li>\n\n<li>Privileges: the user who owns the editor profile<\/li>\n\n<li>Purpose: list installed extensions and versions, to look for <code>anthropic.claude-code<\/code> 2.1.312 or 2.1.313. Per the docs, <code>--list-extensions<\/code> lists installed extensions and <code>--show-versions<\/code> adds versions <sup><a href=\"#src-30\">[30]<\/a><\/sup>.<\/li>\n\n<li>Read-only or change: <strong>Read-only<\/strong><\/li>\n\n<li>Command:<\/li>\n\n<li>How to interpret: this is the <strong>documented VS Code syntax<\/strong>. The malicious builds were served only from <strong>Cursor&#8217;s<\/strong> marketplace cache. A secondary source reports the Cursor CLI accepts the same flags (<code>cursor \u2026<\/code>), but that is not officially documented in our sources <sup><a href=\"#src-29\">[29]<\/a><\/sup>. A version match is a lead, not proof: confirm with Cursor&#8217;s VSIX hashes and IOC checks. To remove an extension, the docs give <code>--uninstall-extension publisher.extension<\/code>. Removal does not remove an installed backdoor.<\/li>\n\n<li>Not tested by MAG212.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>code --list-extensions --show-versions<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Related on MAG212 CYBER<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/cyber.mag212.com\/the-keys-were-already-inside-mag212-cyber-weekly-november-14-2026\/\">MAG212 CYBER Weekly, 14 November 2026: The keys were already inside<\/a> (full issue and PDF)<\/li>\n\n<li><a href=\"https:\/\/cyber.mag212.com\/subscribe-free\/\">Subscribe free to MAG212 CYBER<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><span id=\"src-26\">[26]<\/span> Cursor, &#8220;Security incident update&#8221;, 13 Nov 2026. <a href=\"https:\/\/cursor.com\/blog\/security-incident-update\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-27\">[27]<\/span> Cursor, &#8220;Claude Code extension security notice&#8221;, 29 Oct, updated 30 Oct 2026. <a href=\"https:\/\/cursor.com\/blog\/claude-code-extension-security-notice\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-28\">[28]<\/span> GovInfoSecurity (ISMG), &#8220;Cursor confirms Anthropic Claude Code extension compromised&#8221;, 30 Oct 2026. <a href=\"https:\/\/www.govinfosecurity.com\/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-29\">[29]<\/span> AiCybr, &#8220;Cursor Claude Code extension 2.1.313 marketplace compromise: response&#8221;, 30 Oct 2026. <a href=\"https:\/\/aicybr.com\/blog\/cursor-claude-code-extension-2-1-313-marketplace-compromise-response\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-30\">[30]<\/span> Visual Studio Code docs, &#8220;Command line interface&#8221;, Current. <a href=\"https:\/\/code.visualstudio.com\/docs\/configure\/command-line\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-31\">[31]<\/span> BleepingComputer, &#8220;Fireworks AI discloses new breach after cloud provider hack&#8221;, 10 Nov 2026. <a href=\"https:\/\/bleepingcomputer.com\/news\/security\/fireworks-ai-discloses-new-breach-after-cloud-provider-hack\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-32\">[32]<\/span> Fireworks AI, &#8220;October 2026 security incident (not fetched)&#8221;, Oct\u2013Nov 2026. <a href=\"http:\/\/fireworks.ai\/security\/bulletins\/october-2026-security-incident\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-33\">[33]<\/span> Fireworks AI, &#8220;October 2026 security incident update (not fetched)&#8221;, Nov 2026. <a href=\"https:\/\/fireworks.ai\/security\/bulletins\/october-2026-security-incident-update\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-34\">[34]<\/span> Notion, &#8220;Security incident involving a third-party AI vendor (help centre)&#8221;, Early Nov 2026 (page undated). <a href=\"https:\/\/notion.com\/help\/security-incident-involving-a-third-party-ai-vendor\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n\n<li><span id=\"src-35\">[35]<\/span> Notion, &#8220;Security advisory: third-party AI vendor incident&#8221;, 9 Nov 2026. <a href=\"https:\/\/www.notion.com\/security\/advisories\/security-incident-involving-a-third-party-ai-vendor-nov9\" rel=\"noopener\" target=\"_blank\">link<\/a><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Written and edited by El Mostafa Ouchen for MAG212 CYBER. Facts checked against the sources above as of 14 November 2026, 10:05 AM PST. Diagrams are original MAG212 CYBER illustrations.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>An exposed key at AI vendor Fireworks led to a backdoored extension in Cursor&#8217;s marketplace cache and exposed Notion AI transcripts. What happened and what to check.<\/p>","protected":false},"author":1,"featured_media":4254,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[38,13,15],"tags":[369,142,370,367,368],"class_list":["post-4284","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artificial-intelligence","category-cyber-incidents","category-threat-intelligence","tag-ai-supply-chain","tag-cursor","tag-developer-security","tag-fireworks-ai","tag-notion"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=4284"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/4284\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/4254"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=4284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=4284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=4284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}