[Cursor Discloses Security Incident Investigation: Partial User Data Breach] According to a recent security incident investigation, as reported by DeepFlow TechFlow on November 14th, attackers obtained access keys issued by Cursor to Fireworks, copied some programmable agent tracing data from shared storage, and used un-anonymized credentials to access some internal SaaS tools. Cursor stated that attackers accessed some archived non-production source code, customer support data, and emails. Less than 0.05% of tracing data was compromised for users who did not enable privacy mode; less than 0.01% of customer API credentials were exposed. The company stated that it has directly notified affected customers and believes the incident is under control. On October 29th, the attackers also used the stolen credentials to place a malicious version of the Claude Code extension in the Cursor extension marketplace cache. Up to approximately 5,000 users may have accessed this version, which was removed approximately 11 hours later.