# Cursor traces its security incident to an access key leaked by Fireworks



Cursor



An attacker used an access key exposed by Fireworks to copy old agent traces from non-Privacy Mode sessions, then used credentials in them to reach internal tools. Traces of under 0.05% of users leaked, and each was notified; if you didn't get a notice, your traces were not involved. Cursor believes the incident is contained.

- Announcement time: Nov 14, 2026 09:13 · Beijing Time (UTC+8)
- Review updated: Nov 14, 2026 12:04 Sat · Beijing Time (UTC+8)

## Sources

- Source excerpt: https://x.com/cursor_ai/status/2121411147714970092
- Source archive: https://cursor.com/blog/security-incident-update

Canonical entry: https://www.ailyre.com/source/?id=cursor-security-incident-investigation-update-2026-11-13&lang=en