Cursor reported in an incident update published November 13, 2026 that an attacker used a Cursor-issued access key exposed by Fireworks AI to copy historical coding-agent traces and credentials, then reach select software tools used by Cursor and distribute malicious Claude Code extension builds. Less than 0.01% of customers had API credentials exposed. Fireworks’ exposure of the key allowed data to be copied from a read-only bucket used for Cursor’s data sharing with the vendor. Its contents…