Ransomware crew used Cursor AI to breach seven companies

A ransomware gang used Cursor's AI coding agent to help break into at least seven companies, and the way it got the agent to cooperate is the part you should care about: the attackers told it the hacking was a test. Reuters reported the campaign on August 27 based on a report from the Tel Aviv security startup Gambit Security. No exploit, no jailbreak prompt sold on a forum. Just a plausible-sounding lie about the environment.

What actually happened

Gambit found a server that a gang calling itself Aur0ra had left exposed to the internet, and pulled 28 chat sessions between the operators and a Cursor agent, spanning April 8 to May 21. Per Reuters' reporting, the agent was persuaded to run hundreds of malicious operations — hunting administrator accounts, working through credential theft, suggesting password-hash cracking — because the humans framed every step as a simulation.

Reuters independently identified six victims from the chat data: the Belgian hygiene manufacturer Christeyns, German garage-door maker Teckentrup, Scotland's Helideck Certification Agency, an Argentine pharmaceutical distributor, an Italian manufacturer, and Bayou Title, a Louisiana title insurance company that later showed up on Aur0ra's leak site. Gambit's own estimate is that the tooling sped the attacks up by roughly 30 to 50 percent — not new capability, just less typing. Reuters says SpaceX, Cursor, and Anthropic did not respond to requests for comment.

Read the transcripts and the tone is what lands. Terse operator commands, then the agent replying in cheerful emoji-laden chatbot voice that a VPN connected successfully. It was being helpful. That was the whole problem.

Why AI agent guardrails matter for your business

You are not Aur0ra's target profile, but you probably run the same shape of system. If you've handed a coding agent shell access, a repo, and a set of credentials, you have built the exact thing that gang rented: a fast, tireless operator that reasons about context it cannot verify.

The failure here was not the model's judgment. It was that judgment was the only control in the path. An agent's belief about whether it's in staging is not a security boundary — it's a sentence in a prompt. The boundary has to sit under the agent, where a lie can't move it.

Three things that are worth doing this week. Give the agent its own credentials with its own blast radius — separate accounts for staging and production, and no path from one to the other. Log what the agent runs, not just what it says — command-level audit, retained somewhere the agent can't write to. Put a human gate on the irreversible verbs: credential reads, prod deploys, mass deletes, anything touching customer data. Everything else can run wide open.

If your answer to "what could our coding agent reach at 2am" is a shrug, that's the finding. Fix the scope, not the prompt.

Sources: Reuters via Insurance Journal, Business Standard.