SecurityMedium

Cursor breach started with a leaked vendor key

Cursor says one leaked vendor key led to up to 5,000 developers receiving a backdoored coding extension.

Close-up of colourful source code on a screen
Close-up of colourful source code on a screen. Photo: Chris Ried, via Unsplash
5,000Developers who got the backdoored extension (up to)

Confirmed

  • Cursor says one leaked vendor key led to developers receiving a backdoored extension
  • Cursor says up to 5,000 developers received the backdoored extension

Not yet known

  • Unconfirmed: a WhatsApp file let a hacker control a computer for five days
  • Unconfirmed: $800 loss linked to the WhatsApp file
  • Who carried out the breach

What we know

Per Cursor's own account, a single leaked vendor key led to up to 5,000 developers getting a backdoored extension. The same post notes a well-known trader says a WhatsApp file let a hacker control his computer for five days, leaving him $800 (unconfirmed).

What people are posting

Posts on X this story draws on. They are individual users' views and have not been verified by Global Eye 24.

@Kylechasse

“One leaked vendor key. Up to 5,000 developers got a backdoored coding extension.”

View post →

By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.