Aurora ransomware crew used Cursor's AI agent to breach seven companies
A Russian-speaking affiliate of the Aurora ransomware operation used Cursor's built-in coding agent, running on Anthropic's Claude Sonnet 4.5, to help scan networks, steal credentials and configure VPNs during intrusions at seven companies across three continents between April and May, according to an investigation by Gambit Security first reported by Reuters. The operators got around the agent's refusals by framing the work as an authorized security test.
why it mattersThe clearest documented case yet of a real ransomware crew using an AI coding agent as an operational tool, not just for writing malware.