Summary
- Researchers recovered more than two dozen Cursor chat sessions associated with malicious intrusion activity by the Aur0ra operation.
- European organisations identified in reporting include companies in Belgium and Germany alongside victims in Scotland and Italy.
- The operator repeatedly described malicious activity as authorised testing when the AI agent refused requests.
Cybercriminals used the Cursor AI coding agent during attacks against organisations in Europe and elsewhere, providing a documented example of a commercial agent being incorporated directly into live intrusion work.
Researchers at Gambit Security discovered the activity after finding an exposed server associated with the Aur0ra ransomware operation. The material included more than two dozen chat sessions between an operator and Cursor covering malicious technical activity.
Reuters reviewed parts of the recovered data and identified victims including Belgian cleaning and hygiene-products company Christeyns, German manufacturer Teckentrup, and organisations in Scotland, Italy, Argentina, and the United States.
The reporting does not establish the same outcome at every organisation. The precise contribution made by Cursor to each intrusion, the full extent of any data loss, and whether every incident progressed to extortion remain uncertain.
The conversations nevertheless provide direct evidence of an AI coding agent being used during malicious operations. Researchers found the attacker asking Cursor to assist with tasks including credential theft and exploitation.
When the agent refused some requests it considered harmful, the operator repeatedly described the activity as authorised security testing or a simulation and restarted sessions when necessary.
The pattern shows a practical limitation in controls that rely partly on context supplied through a conversation. Legitimate developers and security researchers can need assistance with many of the same technical tasks used during an intrusion, making intent difficult for a model to infer from code or commands alone.
Cursor itself has undergone a major corporate change this month. The platform’s developer, Anysphere, announced on 14 August that Cursor had become part of SpaceX following an acquisition. The product’s terms continue to identify Anysphere as the maker of the Cursor platform.
The malicious use described in the Aur0ra material does not indicate that Cursor autonomously selected targets or conducted attacks without human direction. An operator supplied objectives, interacted with the system, and attempted to overcome refusals.
The operational change is subtler. Tasks that previously required manual scripting, searching, troubleshooting, or command interpretation can be delegated to an interactive agent that remains available throughout an intrusion.
That can reduce friction for an attacker without eliminating the need for human judgement. An operator still requires access, intent, and enough technical understanding to guide the activity, but the amount of work needed between individual stages of an intrusion can fall.
Cyber Insider recently reported separate ransomware activity involving Claude Code. The Cursor case adds another commercial coding agent and a different operation to the evidence that general-purpose development tools are entering criminal workflows.
The cases also create a difficult control problem for AI providers. Blocking all requests involving credentials, exploitation, or system administration would interfere with legitimate development, testing, and incident-response work. Accepting the user’s stated context too readily creates the opposite problem when malicious operators pretend to have authorisation.
For organisations deploying AI agents internally, technical authorisation can provide a stronger boundary than conversational intent. Identity, tool permissions, network access, environment controls, and independently enforced policy can limit what an agent is physically able to do regardless of how a task is described.
The Aur0ra material does not demonstrate autonomous AI replacing cybercriminals. It shows a nearer-term development: an attacker using a commercial coding agent as part of ordinary intrusion activity against real organisations and repeatedly attempting to manipulate its safeguards when they obstructed the work.
