[Cursor Updates Security Incident Update: Most Users Unaffected, Affected Users Directly Notified] Cursor has released an update on its recent security incident. After a two-week comprehensive investigation, the incident stemmed from attackers obtaining an access key they had issued to Fireworks. This key was leaked by Fireworks, allowing them to copy limited programmable agent link tracing data and further compromise some SaaS tools, accessing some archived source code and support data. The attackers then used the stolen credentials to place malicious copies of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313) in the Cursor VS Code extension marketplace distribution cache on October 29th. Up to approximately 5,000 users may have been affected; this malicious version was removed after approximately 11 hours.