Hackers used Cursor's AI coding agent in a real ransomware campaign: what the Aurora case shows

A story that sounds like science fiction made the security rounds in late August: hackers used an AI coding assistant to help run a ransomware attack. It is true, and it matters, but the way it is being told often gets the most important part backwards. Here is what the researchers actually found, what is genuinely new about it, and what it does and does not mean for everyone now using AI coding tools.

What actually happened

Between 8 April and 21 May 2026, an affiliate of the Aurora ransomware operation used Cursor's "Agent," the agentic mode of the popular AI coding tool, running Anthropic's Claude (Sonnet 4.5), to assist with intrusions into companies. Roughly 7 to 10 organisations were tied directly to these AI-assisted sessions, part of a broader Aurora campaign that researchers say touched more than 20 organisations in total.

The operator did not use the AI to write the ransomware from scratch or to break in from the outside. It used the agent as an in-network assistant once inside: to help with reconnaissance, scan internal networks, map out Active Directory, and work through privilege escalation, the tedious middle stage of an attack. In some logged sessions the agent even offered a numbered list of suggested next steps, and the operator simply replied with a number.

The key detail: assistant, not autonomous

This is the part to get right. In every documented case, the human was in control and already had a way in before the AI was ever involved. Researchers found no evidence of the agent acting on its own. The AI made a skilled attacker faster, one researcher estimated on the order of 30 to 50 percent faster, but it was an accelerant, not an autonomous attacker.

That distinction matters because a genuinely different, separately reported case shows the other end of the spectrum: a strain nicknamed "JadePuffer," documented by Sysdig, is described as the first fully autonomous, end-to-end AI-run ransomware, where an AI agent exploited a flaw, harvested credentials, moved through a network and encrypted data with no human in the loop. Aurora is the opposite model, human-led and AI-accelerated. Keeping the two apart is the cleanest way to separate the real signal from the hype.

How they got past the AI's guardrails

The most instructive finding is how ordinary the bypass was. When the coding agent refused a task that looked malicious, the operator did not find a technical exploit. They simply abandoned the session, opened a fresh one, and reframed the same request as a "simulation" or an "authorised penetration test," which usually got compliance. It is social engineering aimed at the model's context rather than at a person. No flaw in Cursor was involved; researchers describe it as an ordinary paid tool abused through ordinary access.

Two things are worth noting for balance. First, the guardrails were not useless: they forced the attacker to keep working around them, and many of the agent's commands failed on the first try and needed refining, which is itself noisy and detectable. Second, this behaviour of reopening sessions and re-asking is exactly the kind of pattern defenders can learn to spot.

How researchers caught it

The operation was exposed by a basic mistake: the operator left a server open on the public internet with no password, and it contained the evidence, credential dumps, shell history, the ransomware itself, and the AI chat logs. Those logs are why this case is documented in such unusual detail: researchers could read, almost turn by turn, how the attacker used the tool. (One point of confusion worth clearing up: a specific "authorised internal deployment" jailbreak phrase reported around the same time belongs to a different, unrelated case, not to Aurora.)

What it means, and how to defend against it

The takeaway is not to fear AI coding tools, which are overwhelmingly used for legitimate work. It is that the same agentic capability that helps a developer move faster helps an intruder move faster too, and that a model's built-in refusals are one control, not a wall. Practical steps for developers and security teams:

• Do not rely on AI guardrails alone. Assume model refusals can be talked around, and design as if they will be.
• Constrain what an AI agent can reach. Give coding agents least privilege, limit the environments, credentials and networks they can touch, and log and monitor their actions as you would a human operator's.
• Treat developer tooling and credentials as entry paths. These intrusions leaned on valid, stolen credentials; the agent just amplified them.
• Harden the boring middle. The attackers leaned on well-known Active Directory weaknesses; enforcing SMB signing, auditing certificate-services templates and rotating key accounts closes much of that ground.
• Protect your virtualisation and backups. Isolate management networks, alert on mass virtual-machine shutdowns, and keep immutable backups, because the fastest case went from access to ransom in about two weeks.

For more on how AI agents get turned against their users, see our reports on the GhostSplice attack on AI coding agents and AI models being tested for cyber skills, and browse our full software coverage.

Frequently asked questions

Did hackers really use Cursor's AI in a ransomware attack?

Yes. Security firms Gambit Security and CloudSEK documented an Aurora ransomware affiliate using Cursor's AI coding agent to assist intrusions into roughly 7 to 10 organisations between April and May 2026, reconstructed from the attacker's own exposed chat logs.

Was the AI acting on its own?

No. A human operator was firmly in control and had already gained access before using the agent; researchers found no independent action by the AI. It sped up a human attacker rather than replacing one. A separate reported case, "JadePuffer," is the one described as fully autonomous.

Which AI tool and model were involved?

Cursor's "Agent" mode, running Anthropic's Claude, according to the researchers who recovered the session logs.

How did the attacker get past the AI's safety guardrails?

Not with a technical exploit. When the agent refused, the operator started a fresh session and reframed the task as a "simulation" or "authorised penetration test," which usually got compliance. It is manipulation of the model's context, and no flaw in Cursor was involved.

Can AI be used for ransomware?

Yes, to speed up reconnaissance, scripting, privilege escalation and negotiation. But in this case it assisted a human who already had access, rather than breaking in by itself. It is a force multiplier, and its refusals can be talked around, which is why other defences matter.

How many companies were affected?

Roughly 7 to 10 intrusions were tied directly to the AI-assisted sessions, part of a wider Aurora campaign that researchers say reached more than 20 organisations overall; the exact figures vary between reports because they count different things.

How was the operation discovered?

The operator left a server exposed on the public internet with no authentication. It held credential dumps, shell history, the ransomware and the AI chat logs, which researchers analysed.

Is Cursor to blame for this?

Researchers allege no flaw in Cursor; it was an ordinary tool abused through ordinary, already-obtained access. (Cursor's maker was acquired by SpaceX in a deal that closed in August 2026, after these April-to-May attacks, so it was an independent product at the time.)

Is this the first time AI was used in a cyberattack?

No. AI-assisted attacks were documented through 2025, and "JadePuffer" was reported as the first fully autonomous AI-run ransomware. Aurora is notable specifically as one of the first documented uses of a mainstream agentic coding assistant, hands-on, inside live victim networks, as an accelerant to a human attacker.

What should developers and security teams do about it?

Do not treat AI guardrails as the only control: restrict what agents can access, log their actions, protect developer credentials, harden Active Directory and virtualisation, and keep immutable backups. Agent-driven activity is noisy and iterative, which gives defenders a detection signal.