According to CoinMeta, Cursor announced the investigation results of the Claude Code plugin poisoning incident, identifying that the source of the attack was their AI service provider, Fireworks. Fireworks leaked an access key for Cursor, and hackers used this key to copy the historical Coding Agent operation records stored in shared storage, affecting less than 0.05% of users. Among them, less than 0.01% of users had their API credentials exposed. On October 29th, hackers used the stolen credentials to tamper with the extension store cache, providing malicious versions of Claude Code (versions 2.1.312 and 2.1.313) that implanted a backdoor. These malicious versions were active for about 11 hours, and up to 5,000 users may have downloaded them. Cursor stated that sessions in private mode, customer code repositories, and production systems were not affected. The last instance of hacker activity was detected on November 1st, and affected users were successfully notified. Fireworks was immediately discontinued from processing inference requests, their data access permissions were revoked, and internal credentials were rotated.