Aurora Ransomware Affiliates Ran Live Intrusions Through Cursor's AI Agent Against Ten Organizations

Ten organizations breached between April 8 and May 21, 2026, part of more than 20 hit across nine countries from April to July; named victims include Christeyns, Teckentrup, the Helideck Certification Agency, and Bayou Title

CloudSEK and Gambit Security published parallel analyses on August 31, 2026 of an Aurora (Aur0ra) ransomware affiliate that used Cursor, the agentic coding assistant, as its hands-on-keyboard tool during live intrusions. Gambit recovered 28 chat sessions in which the operator handed the agent valid credentials or an existing route, including SOCKS-based access, then tasked it with reconnaissance, domain privilege enumeration through NetExec, internal subnet scanning, VPN client installation, proxychains configuration, NTLM relay, and Active Directory certificate attacks. The operator wrote prompts in Russian and instructed the agent to exclude CIS address ranges and CIS-country domains without exception. Both firms are explicit that the agent never acted independently: a human ran the intrusion and steered the assistant session by session, and Gambit's Eyal Sela noted that most commands "failed to achieve the stated objective on the first attempt, resulting in multiple refinements." The Windows and Linux/ESXi payloads are written in Zig; the Windows build deletes volume shadow copies and disables System Restore, and the Linux/ESXi variant force-terminates virtual machines before encrypting. Ransomware.Live lists 33 Aurora victims in the US, Germany, the Netherlands, Canada, and the UK

A general-purpose coding agent with shell access, no notion of who its operator is or what the target is, used as an interactive intrusion console. Nothing was jailbroken and no exploit targeted Cursor itself; the product performed as designed for an attacker who supplied their own access. The interest of the case is that it separates AI-assisted intrusion from autonomous intrusion using recovered session logs rather than inference