Cursor security incident history
Hacking, data breaches and other security incidents involving Cursor, with related coverage.
Aurora ransomware targets Cursor, prompting discussion of detection
Cursor was targeted by Aurora ransomware. Darktrace’s CEO explained attacks that evade existing defenses and behavior-based detection.
Read on EnterpriseZine ↗Malicious Claude Code extensions distributed through Cursor marketplace
5KImpact: Up to 5,000 developers potentially exposed to malware
Tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were distributed through Cursor's extension marketplace for about 11 hours, potentially exposing up to 5,000 developers to malware. The malicious extensions transmitted host information and installed attacker SSH keys and persistence components or attempted to establish reverse SSH tunnels. Cursor removed the packages and temporarily suspended and rebuilt the marketplace. Cursor later confirmed that the malicious extensions had been distributed through a breach using credentials stolen from AI infrastructure provider Fireworks.
Related reports: 5 · last report →