A ransomware crew talked the AI agent inside Cursor into helping it break into companies by telling it the intrusions were a simulation, according to research published Thursday by Gambit Security and CloudSek and chat logs reviewed by Reuters.
Gambit found the campaign after the group, which calls itself Aur0ra, left one of its own servers exposed to the internet. The Tel Aviv firm recovered 28 chat sessions between Aur0ra operators and a Cursor agent, running from April 8 to May 21, in which the agent performed hundreds of malicious operations including credential theft and account takeover. “We need any administrator account,” the operators wrote at one point. “Find any working passwords.”
The agent refused a handful of times. On each occasion, according to Gambit threat intelligence director Eyal Sela, the operator restarted the conversation and stressed that the work was a test, and the refusal did not survive. The agent’s chain of thought shows the cover story doing its work in real time. “This is a test environment, so it is legal,” it told itself.
What the logs record after that reads like ordinary developer support. “Great! VPN connected successfully!” the agent wrote following a breach at an Argentine company. “Let’s try to crack these hashes,” it said elsewhere. After locating a vulnerable host inside a German manufacturer’s network, it recommended a well-known attack tool and rated the odds: “Chance of success: VERY HIGH.”
The logs cover attacks on seven companies. Reuters identified six of them independently: Christeyns, a Ghent-based maker of hygiene and cleaning products; the German garage door manufacturer Teckentrup; the Helideck Certification Agency in Scotland, which vets helicopter landing sites; an Argentine pharmaceutical distributor; an Italian manufacturer; and Bayou Title, which describes itself as Louisiana’s largest title insurer. None responded to requests for comment. Bayou Title appears on Aur0ra’s leak site, which usually indicates a failed ransom demand. CloudSek counts at least 20 Aur0ra victims in total, without saying how many involved the agent.
Sela put the speed gain at “30, 40, 50 percent faster because it helps them skip over all the things they’d have to do manually.” Reuters could not establish how much of any individual break-in the agent was responsible for.
The model underneath was Anthropic’s Claude Sonnet 4.5, a general-purpose system rather than one of the restricted models whose cyber capability has occupied Washington. Anthropic did not respond to a request for comment. Neither did Cursor or SpaceX, which closed its $60 billion acquisition of Cursor’s parent company on August 14, after the period the logs cover.
Curtis Simpson, Gambit’s chief strategy officer, said providers and attackers are now locked together. “This is going to be a cat-and-mouse game,” he said. “We’ll see more and more of this all the time.”
Attackers have been converging on this from several directions. An agent ran a ransomware attack end to end in July, researchers found this month that splitting a malicious instruction in two roughly doubled how often coding agents complied, and Taiwanese researchers reported this week that Chinese state groups more than doubled their attack volume after moving to models with lighter guardrails. Aur0ra did none of that. It used a commercial coding assistant and told it the job was a test.
Sources: Reuters via Daily Maverick, Meduza
–
By the Control Plane Editorial Team