Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, Cursor, an AI-powered code editor, confirmed a multi-stage supply-chain breach in which attackers compromised a Fireworks AI access key stored in a shared storage bucket. The stolen key exposed historical AI coding-agent traces containing unredacted API credentials, enabling lateral pivot into Cursor's internal SaaS tools and extension marketplace. On October 29, attackers leveraged a stolen marketplace credential to publish two malicious versions of Anthropic's Claude Code extension (v2.1.312 and v2.1.313), exposing up to 5,000 developers to SSH-backdoor malware for approximately 11 hours before detection and removal.

This breach is part of a documented wave of attacks against AI developer platforms—dubbed 'Black October' by Wiz—in which credential theft targeting AI inference and training infrastructure has become a primary vector. As AI toolchains deepen integration across developer workflows, unredacted secrets persisting in AI trace logs and third-party model providers represent an expanding, underappreciated attack surface for supply-chain compromise.

Why This Matters Now

AI developer platforms are now primary targets: attackers are systematically harvesting credentials from AI inference providers and agent trace logs to hijack extension marketplaces and developer toolchains. With millions of developers relying on AI-integrated IDEs, a single compromised marketplace credential can weaponize trusted extensions at scale—demanding urgent controls around secret redaction, third-party key hygiene, and egress enforcement across AI supply chains.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers first obtained a Fireworks AI access key stored in a shared storage bucket, which exposed historical AI coding-agent traces containing unredacted API credentials. Those credentials granted access to Cursor's internal systems, including the marketplace publishing credential used to distribute malicious Claude Code extensions.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the entire attack chain relied on credential reuse and unrestricted lateral access across cloud-hosted SaaS infrastructure. By enforcing workload-level segmentation, identity-scoped access paths, and controlled egress, Aviatrix would likely have reduced the attacker's reachability across Cursor's internal systems and constrained the blast radius before supply chain injection became possible.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Segmented access boundaries between Cursor's cloud workloads and third-party provider infrastructure would likely have constrained how far a compromised partner credential could reach within Cursor's own environment, reducing the initial foothold's usable scope.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely constrain how harvested credentials could be reused across internal SaaS and marketplace systems, reducing the privilege scope an attacker could achieve even after recovering credentials from exposed storage traces.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the number of internal SaaS systems reachable from a single compromised credential, constraining lateral pivot paths between source code repositories, customer support platforms, and marketplace infrastructure.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and policy enforcement would likely surface anomalous write activity against the marketplace cache layer and may constrain unauthorized credential use across cloud control planes before malicious extension staging completes.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement would likely constrain outbound data flows from cloud-hosted storage and SaaS APIs to known, authorized destinations, reducing the volume and reach of data that could be exfiltrated using valid but stolen credentials.

Impact (Mitigations)

Had prior-stage controls constrained lateral movement and write access to the marketplace cache, the window of developer exposure would likely have been narrower, and the number of workstations receiving malicious extension builds may have been reduced before the supply chain injection was detected.

Impact at a Glance

Affected Business Functions

  • AI-Powered IDE Extension Marketplace Distribution
  • Developer Credential and API Key Management
  • AI Coding-Agent Trace Storage and Model Training Pipeline
  • Customer Support and SaaS Tool Infrastructure
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Up to 5,000 developer endpoints were exposed to malware delivering persistent SSH backdoors via malicious Claude Code extension versions 2.1.312 and 2.1.313, available for approximately 11 hours on October 29. Fewer than 0.05% of Cursor users had historical AI coding-agent traces exposed from a read-only storage bucket; these traces contained unredacted API credentials. Fewer than 0.01% of customers had API credentials directly compromised. Additional data stolen via lateral movement using those credentials included: archived non-production source code repositories containing business contact information, limited customer support emails and conversation summaries, product usage metrics, customer contact details, and credentials previously shared with Cursor support. Production infrastructure, official application binaries, and data belonging to users with Privacy Mode enabled were confirmed unaffected. The financial loss figure is reported as $0 direct loss to Cursor at time of disclosure, though downstream developer systems compromised via SSH backdoors may carry unreported remediation costs. The broader Black October campaign context suggests potential for unauthorized AI inference abuse using stolen credentials across affected platforms.

Recommended Actions

  • •

    Enforce Zero Trust Segmentation for third-party data-sharing surfaces: Cursor's shared training-data bucket with Fireworks AI should have been governed by identity-based, least-privilege policies. CNSF Zero Trust Segmentation controls (mapping to ZTMM.Network, NIST.800-53.AC-6) would limit any single compromised third-party credential to a narrowly scoped, non-sensitive data surface—preventing the credential from reaching AI trace data containing unredacted secrets.

  • •

    Apply Egress Security and Policy Enforcement to block unauthorized outbound data movement: Exfiltration of source code, customer data, and AI traces via cloud storage APIs should be controlled by CNSF Egress Security capabilities including FQDN filtering and outbound traffic policy enforcement (mapping to ZTMM.Data, NIST.800-53.SC-18, NIST.CSF.PR.DS-5). Blocking unapproved egress destinations from cloud workloads would have constrained data theft even after credential compromise.

  • •

    Deploy Multicloud Visibility and Control to detect anomalous cross-service API activity: The lateral movement across Cursor's SaaS tooling using harvested credentials should have triggered anomaly alerts. CNSF Multicloud Visibility capabilities (mapping to ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6, NIST.CSF.DE.CM-7) provide centralized traffic observability and can flag abnormal cross-service authentication patterns, repeated bulk API reads, and suspicious automation behavior indicative of credential-driven pivoting.

  • •

    Use East-West Traffic Security controls to restrict workload-to-workload and service-to-service access: Once attackers moved from the Fireworks-integrated bucket into internal Cursor systems, unrestricted east-west paths enabled access to marketplace infrastructure. CNSF East-West Traffic Security (mapping to ZTMM.Network, NIST.800-53.SC-7) with microsegmentation would isolate the marketplace cache write endpoint from general internal credential scope, ensuring a compromised support or training-data credential cannot reach extension distribution infrastructure.

  • •

    Leverage CNSF Cloud Native Security Fabric for AI supply chain and agentic workload protection: The core attack vector—AI coding-agent traces retaining unredacted credentials in cloud storage—represents an AI-specific data governance failure. CNSF Cloud Native Security Fabric capabilities (mapping to ZTMM.CrossCutting.Automation, NIST.800-53.SI-4, NIST.CSF.ID.RA-3) address agentic AI and shadow AI risk through inline enforcement and real-time inspection of AI workload outputs, reducing the likelihood that model training pipelines retain and expose sensitive credential material in downstream storage.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image