According to CoinMeta, Cursor has released the investigation results of the claude code plugin poisoning incident. The source of the attack was due to the access key leaked by AI service provider fireworks. Hackers used this key to obtain the coding agent operation records of users who did not have privacy mode enabled in 2025, and they also used the unmasked API key to intrude into internal services, stealing non-production code, customer service emails, and user credentials. On October 29th, hackers used the stolen credentials to tamper with the extension store cache and released claude code versions 2.1.312 and 2.1.313 that contained a backdoor. The malicious versions were active for about 11 hours, and up to 5,000 users may have downloaded them. This leak affected less than 0.05% of the users, with less than 0.01% of those users having their API credentials exposed. Sessions with privacy mode enabled, customer code repositories, and production systems were not affected. Cursor intercepted the hacker activities on November 1st, stopped using fireworks to process inference requests, revoked their access rights, and rotated the internal credentials.