SAN FRANCISCO - Two security breaches at inference provider Fireworks AI within 18 days have cascaded into downstream compromises at Notion and AI code editor Cursor, according to advisories updated Nov. 12 through Nov. 14. In Cursor's incident, attackers used an exposed key to plant malicious marketplace extensions targeting up to 5,000 developers.
What happened?
Cursor confirmed on Nov. 13 that hackers compromised a Fireworks AI access key in a shared storage bucket, exposing historical coding-agent traces containing unredacted credentials. "On October 29, attackers leveraged a stolen marketplace credential to publish two malicious versions of Anthropic's Claude Code extension (v2.1.312 and v2.1.313), exposing up to 5,000 developers to SSH-backdoor malware for approximately 11 hours," security firm Aviatrix reported on Nov. 14. Separately, Notion disclosed on Nov. 12 that a second Fireworks AI breach exposed AI chat transcripts affecting less than 1% of Notion workspaces.
Why does it matter?
The back-to-back incidents illustrate how unredacted logs and training datasets at third-party AI model hosts create wide supply-chain blast radii. Although Fireworks AI initially indicated only synthetic test data was touched, a Nov. 8 investigation confirmed real customer transcripts appeared in a compromised dataset. Notion disconnected Fireworks on Nov. 3, deleted its stored data on Nov. 4, and notified affected customers on Nov. 9.
What comes next?
Cursor removed the trojanized Claude Code extensions after 11 hours and rotated exposed marketplace credentials, while Fireworks AI issued updated remediation bulletins on Nov. 9. Enterprise security teams are now auditing third-party AI inference logs to prevent unredacted secrets from persisting outside production environments.
