Cursor Links Extension Attack to Exposed Credentials, Up to 5,000 Users Affected

The disclosure matters less for its scale than for what it leaves unsaid: Cursor has confirmed an extension-based compromise and a user ceiling without explaining how credentials were exposed or when, which leaves affected teams unable to scope their own exposure beyond checking machines and rotating secrets. The incident reinforces that AI coding extensions, which inherit broad access to developer environments and repositories, are an attractive supply-chain surface. Whether Cursor provides a fuller timeline and root cause is the open question, and that detail will shape how the developer-tooling sector treats third-party extension vetting.