Source-reported · Independent verification status is not recorded for this article; claims remain attributed to their sources.
Stolen Fireworks AI key lets attackers slip backdoored Claude Code extension into Cursor update
A stolen Fireworks AI key enabled attackers to push a trojanized Claude Code extension through the Cursor coding platform, hiding an SSH backdoor in an automatic update that may have reached up to 5,000 users.
A breach tied to a stolen Fireworks AI key has exposed how AI‑powered coding tools can become a new software supply‑chain weak point.
Security reporting says attackers obtained a Fireworks AI key and used it to compromise Cursor, an AI‑assisted coding environment. They pushed a malicious update that included a trojanized Claude Code extension, which was designed to install an SSH backdoor on developers’ machines.
Up to 5,000 users may have received the compromised extension before the issue was detected and addressed, according to technical accounts. There’s no public data yet on how many systems were actually exploited or what, if anything, the attackers managed to extract.
For developers who installed the affected update, the risk is that the SSH backdoor could have given intruders a path into local machines and, from there, into corporate repositories and infrastructure that rely on the same credentials.
The incident shows how deeply AI tools have been woven into everyday development work. AI extensions and assistants often auto‑update and hold broad permissions, but aren’t always treated as potential attack surfaces in the same way as build systems or package registries.
One stolen API key in this case was enough to turn a trusted AI integration into a delivery channel for malware, reaching thousands of endpoints through regular update mechanisms.
Points to watch now include the findings of any forensic investigations into actual compromise, whether other AI tool vendors disclose similar incidents linked to stolen keys, and what new safeguards platforms put in place around extension signing, permissions, and update transparency.