A stolen partner key was enough to put a trojanized Claude Code extension on an official marketplace this week.

Cursor says an attacker obtained an access key the company had issued to Fireworks AI. That key spilled in a Fireworks breach. The attacker used it to copy data from a read-only path and then operate against Cursor’s extension marketplace, landing on Anthropic’s official Claude Code listing. If you let developers install AI coding tools from a trusted store, this is a cybersecurity incident in the identity layer you probably never put on a heat map.

The badge still said official.

The update still looked like a vendor push.

Stolen keys now steer cybersecurity programs

Help Net Security’s week-in-review headline did you a favor by putting the pieces on one line. A secret stealer hit GitHub repos. Claude Code showed up as a remote-controlled implant. Those are the same story told twice.

Secrets leak from repos, CI logs, partner tenants, and read-only API surfaces that nobody treated as publish rights. Whoever holds the publisher credential becomes the publisher. You can spend a decade tuning threat detection for malware families and still bless the implant because it arrived with the right key.

Italy just fined Meta $887 million over Facebook’s grab of Android gallery photos and videos. The authority treated the smartphone as part of a person’s private sphere and demanded free, informed consent before that kind of access. Your coding agents got none of that scrutiny. A partner key substituted for consent, and the IDE executed whatever the marketplace served.

That is a bad look for every vendor that issues long-lived marketplace credentials to contractors and model hosts, then files those credentials under vendor management.

Official updates skip the firewall

Your firewall did not see a brute-force campaign against the IDE.

Threat-protection stacks that inspect inbound exploits will pass a signed marketplace package without a shrug. Defense in depth that ends at the edge is covering a door the attacker never used. They authenticated as a publisher. The workstation then becomes the callback host. Your SOC is still watching the data center.

Developer laptops already hold GitHub tokens, cloud CLIs, and production kubeconfigs. A remote-controlled coding extension inherits that pile. You are not containing a plugin. You are containing a privileged user who thinks they installed a helper.

Brute-force noise against VPN and SSO still deserves IP bans and lockouts. Useful. Incomplete. A valid stolen key does not fail those controls. It walks through them. Cyber security programs that count failed logins as the identity metric will file this under supply chain after the damage is done.

Threat detection keyed on unsigned binaries misses a listing that still carries vendor identity. Incident response that opens with who hit the VPN starts on the wrong artifact. You want the publish event, the extension version skew, and the outbound callback from the developer workstation.

Security hardening of laptops still leaves you exposed when the approved tool is the implant.

Treat publisher secrets as production identity

Stop arguing about whether AI coding assistants are in scope. They publish code, they hold tokens, and this week they ran someone else’s implant. Handle them like production software distribution.

GitHub secret stealers make the same point without the marketplace drama. A token in a repo is a publish right, a deploy right, and a cloud admin right, depending on how sloppy the scope was. Rotate first. Argue about blame after the keys are dead.

Do this on the same shift you read the advisory, then keep the loop.

• Inventory every marketplace publisher key, extension-signing secret, and CI token issued to a vendor, model host, or contractor. Revoke and rotate on a same-shift clock. Treat a GitHub secret-stealer hit as a burn of every token in that org, including fine-grained PATs and bot accounts.
• Freeze auto-updates for AI coding extensions until you have hashes you trust. Hunt workstations for unexpected Claude Code or marketplace builds. Treat unknown versions as incident response.
• Store publisher keys in a vault with dual control. Alert on marketplace publish events the way you alert on IAM privilege grants. Allowlist extensions by hash, not by friendly name.
• Split developer identities from production deploy identities. Fold AI coding agents into the same security hardening pass you use for build servers. Keep IP bans and lockouts on the identity plane for noisy brute-force, and plan separately for valid stolen keys those controls will never see.

If a partner can publish to your developers, that partner is in your blast radius. Write that into the contract and into the monitoring. Log marketplace publishes. Review extension diffs the way you review IAM policy diffs. The next implant will also look official.

Sources

• Stolen Fireworks AI Key Led to Cursor Claude Code Extension Incident
• Week in review: Secret stealer hits GitHub repos, Claude Code turned into remote-controlled implant
• Meta Fined $887 Million in Italy Over Android Gallery Photos and Videos on Facebook