Cursor disclosed the results of the security incident investigation, with the malicious Claude Code extension affecting up to 5000 users.

Cursor announces investigation results of a security incident involving malicious Anthropic Claude Code extension, affecting up to 5000 users, mainly leaking link tracking data of users who did not use the privacy mode (less than 0.05%); attackers used Fireworks leaked keys to infiltrate some SaaS tools and planted malicious extensions for about 11 hours, Cursor has notified affected users and strengthened security protections.