Cursor confirms breach via Fireworks AI credentials; malicious Claude Code extension distributed

Cursor confirmed a security breach where attackers stole credentials from AI infrastructure provider Fireworks AI to distribute a malicious Claude Code extension through its marketplace. The incident highlights supply-chain risks in AI developer tooling. The full scope of affected users and payload behavior remains under investigation.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works