A breach at Fireworks AI, a company that hosts open AI models for developers, has spread to at least two of its customers. Cursor said on Nov. 13 that an attacker used an access key exposed by Fireworks to copy coding agent traces, some of which contained unredacted credentials, and Uber is notifying drivers that their license information was stolen, TechCrunch reported the same day.
In both cases the stolen material was data the customers had shared with Fireworks, which Cursor used as a model training and inference vendor.
What Cursor found
In a blog post, Cursor said the attacker obtained an access key that Cursor had issued to Fireworks and used it to copy data from a read-only storage bucket the two companies used to share data. The bucket held "limited coding agent traces, mostly from 2025," from sessions that were not in Privacy Mode and that Cursor was permitted to use for model training.
A small number of those traces contained credentials that had not been redacted, and fewer than 0.01% of customers had API credentials exposed, according to the post.
Starting from those credentials, the attacker reached some of the software-as-a-service tools Cursor uses internally. From there the attacker accessed archived non-production source code repositories and limited customer support data, the company said. Product usage metrics were also taken, along with some credentials that users had sent to Cursor's support team.
On Oct. 29, the attacker used a stolen credential to place malicious, unauthorized copies of Anthropic's Claude Code extension on the cache that serves Cursor's VS Code extension marketplace. Cursor said at most 5,000 users who requested specific cached versions that day may have received the tampered build, which was available for about 11 hours. The affected versions are 2.1.312 and 2.1.313, and Cursor said uninstalling the extension alone may not be enough to clean a machine.
Cursor said Anthropic did not publish the copy and the incident was not a vulnerability in Anthropic's product. The upstream marketplace source, Open VSX, never carried the malware, the post said.
Coding agent traces were exposed for fewer than 0.05% of users who were not in Privacy Mode, and Cursor said it has notified each of them. The company said its production systems were not affected, and neither were customer code repositories. The last attacker activity it saw was on Nov. 1, and it was blocked.
Cursor said it has moved all inference traffic off Fireworks, rotated every credential in use across its internal systems and added secret scanning to its code repositories and other internal data sources.
Uber drivers and Notion
Uber told state attorneys general this week that a tech provider notified it on Oct. 9 that hackers had stolen internal credentials and used them to reach Uber data, according to TechCrunch. TechCrunch said it learned the provider was Fireworks AI.
"The notices to drivers are in relation to a security incident impacting one of our third-party vendors, Fireworks.ai, which had access to some Uber data," an Uber spokesperson told the publication.
Breach notices seen by TechCrunch list stolen driver's license data for 2,567 people in Massachusetts, 3,430 in South Carolina and 1,873 in Rhode Island, a combined 7,870. An Illinois filing listed the count as pending, and Uber also notified California drivers without giving a number. Uber did not give a total.
Notion also confirmed its data was stolen in the Fireworks hack, TechCrunch reported. Fireworks had disclosed a breach in October in which customer billing data and some private AI datasets were taken.
A Fireworks spokesperson confirmed unauthorized access to some of its systems that affected customer data but did not answer TechCrunch's questions about the incident. Fireworks attributed the breach to a financially motivated group that sells stolen tokens for access to large language models. No group has claimed the theft, according to TechCrunch.
Source: Cursor, “An update on our recent security incident”
Additional sources: TechCrunch, “Uber confirms hackers stole thousands of drivers' license information in data breach”; Cursor on X, “We've published an update on our recent security incident”
