"This Is an Authorized Exercise"—How the Aurora Ransomware Gang Insisted, While Making Cursor's AI Agent Do the Actual Intrusion Work
Gambit Security and CloudSEK report that the ransomware group Aurora abused Cursor's AI agent for real intrusion work. Posing the tasks as an "authorized exercise" to slip past the safeguards, they had it handle reconnaissance and privilege takeover on the back of stolen credentials—a warning that a
Attackers from the ransomware group "Aurora (Aur0ra)" were using "Cursor Agent"—the AI coding agent provided by Cursor, a SpaceX-affiliated company—to carry out real intrusions into corporate networks. Security firms Gambit Security and CloudSEK revealed this in separate, independent investigations. Reuters first reported it on August 27, 2026, and several other outlets followed.
What's worth noting is that the AI didn't autonomously "hack" anything on its own. The attackers came prepared with stolen credentials and intrusion paths, and then had the agent take over the manual work that followed. In other words, Cursor Agent sped up the attackers' work through the very same mechanism that boosts a developer's productivity.
Insisting It Was an "Authorized Exercise" to Get Around the Safeguards
Normally, agents like this have built-in safeguards that refuse offensive operations. Aurora worked around these by repeatedly claiming that the work was an "authorized simulation" intended for internal use. Because a model can't fully verify the legitimacy of a request from anything beyond the words themselves, it's vulnerable to input that poses as a "legitimate request"—a case of exploiting the structural hole inherent in intent-based guardrails.
What's interesting is that the attackers also imposed "restrictions" of their own on the agent. According to Gambit, across every victim organization they consistently gave three rules: "never perform DCSync," "don't lock out any accounts," and "don't create new computers in the domain." This suggests an operational discipline aimed at avoiding detection and lingering in the victim environment without breaking it.
The Jobs a "Worker" Handled After Being Handed Stolen Keys
Gambit Security recovered conversation logs covering 28 exchanges between the attackers and the agent from an Aur0ra server that had been left exposed to the internet. What the agent was entrusted with was the hands-on work that comes after an intrusion. The model used was Claude Sonnet (claude-4.5-sonnet-thinking).
- Reconnaissance and discovery: scanning internal networks with Nmap and NetExec
- Mapping privileges: enumerating the domain with NetExec's BloodHound collector and checking the privileges of the hijacked accounts
- Securing communication paths: deploying VPN clients and proxychains, and maintaining intrusion paths via SOCKS tunnels
- Credential theft: NTLM relay attacks using PetitPotam, Coerce Plus, PrinterBug, and Impacket's ntlmrelayx
- Abusing certificates: attacks against Active Directory Certificate Services using Certipy
On top of this, Aurora also deployed a Linux version of its ransomware targeting VMware ESXi (encryption via ChaCha20 with RSA-4096 key protection). Taking an entire virtualization platform hostage is a standard playbook of recent targeted ransomware.
What Was Broken Wasn't Cursor—It Was the Premise of "Defending by Intent"
Reading this as "AI agents are dangerous, so don't use them" misses the point somewhat. The reality is that the same benefit legitimate developers enjoy—the power to blaze through tedious, routine work—worked just as well in malicious hands. As part of a broader campaign, CloudSEK reports evidence that more than 20 organizations across nine countries were targeted between April and July 2026 (Gambit's close analysis covered 10 organizations).
Gambit estimates that using the agent sped up the attackers' work by an estimated 30–50% (this is the firm's own estimate, not a definitive figure). Whether or not the number holds, it's worth taking as a warning: when labor-intensive steps get automated, the breathing room left to defenders shrinks too.
The Lines Adopters Should Draw for Themselves
What this incident shows is the reality that you can't rely on vendor-side safeguards alone. Organizations that use coding agents internally need to have preparations like the following in place:
- Credential hygiene: since these attacks presuppose stolen keys, least-privilege access and fast rotation of credentials serve as the first line of defense
- Monitoring outbound traffic: detect behavior such as an agent establishing a VPN or external tunnel, and the execution of unfamiliar attack tools
- Isolating the execution environment: narrow the privileges and network reach you grant the agent, and keep it away from production assets
Behind all the convenience, the same tools can raise the speed of attacks too—this is a case where such risks are beginning to be pointed out alongside concrete damage. Victims confirmed by name include the Belgian detergent maker Christeyns, the German garage-door manufacturer Teckentrup, and Scotland's Helideck Certification Agency.
References: Gambit Security / The Hacker News / Infosecurity Magazine / Unite.AI
