Cursor reported in an incident update published November 13, 2026 that an attacker used a Cursor-issued access key exposed by Fireworks AI to copy historical coding-agent traces and credentials, then reach select software tools used by Cursor and distribute malicious Claude Code extension builds. Less than 0.01% of customers had API credentials exposed. Fireworks’ exposure of the key allowed data to be copied from a read-only bucket used for Cursor’s data sharing with the vendor. Its contents…
Read the original at Unite.AI: Cursor Traces Breach to Access Key Exposed by Fireworks AI
How OpenSmartRoute helps
Stories like this are why the router checks a request before it leaves. The input guard spots prompt injection and personal data. A hard rule can keep that text on an on-premises model, inside a region or under a cost cap, whatever the prompt asks for.
For a team that routes through the router, a release like this is one catalogue entry. The new model competes on the next request against what the team already runs, on quality, cost and speed. If it answers well it earns more traffic; if it fails it gets less, with no code change in the app.