[Cursor Discloses Security Incident Update: Attackers Use Vendor Keys to Tamper with Extensions] Jinse Finance reported on November 14th that Cursor disclosed an update on a security incident. Attackers used access keys leaked from vendor Fireworks to obtain some data, then used the credentials to access some internal Cursor tools. On October 29th, they placed a modified Claude Code extension into the Cursor extension marketplace cache. The malicious version was removed approximately 11 hours later, during which time up to 5,000 users may have received it. Cursor stated that the percentage of customers whose API credentials were leaked was less than 0.01%, and the company has directly notified all affected customers and believes the incident is under control.