Hassan Khan
Israeli security firm Gambit Security published research on August 27, 2026 showing that an operator linked to the Aurora ransomware group used Cursor Agent, running Anthropic’s Claude Sonnet, to carry out hands-on intrusion work against ten target organisations between 8 April and 21 May 2026. Gambit found the evidence on a server the group had accidentally left exposed to the internet. Reuters, which reviewed the same data, reported that at least seven companies were successfully breached, among them Belgian cleaning products maker Christeyns, German garage door manufacturer Teckentrup and the Scotland-based Helideck Certification Agency.
Cursor, the AI coding assistant at the centre of the case, is owned by SpaceX. Neither Cursor nor SpaceX commented on the findings.
What the operator asked the agent to do
The sessions read less like science fiction and more like a junior contractor being managed badly. According to Gambit’s technical write-up, the operator ran Cursor Agent on the claude-4.5-sonnet-thinking model and handed it credentials or an existing route into the victim network. The agent was then set to work on ordinary attacker chores: installing a VPN client or proxychains and connecting through a SOCKS tunnel, scanning internal subnets with Nmap and NetExec, enumerating the domain with NetExec’s BloodHound collector to report what privileges a stolen account held, attempting NTLM relay attacks with PetitPotam, Coerce Plus and PrinterBug, and running certificate attacks with Certipy.
Sometimes the operator gave a goal rather than a command, along the lines of asking what rights a particular user held. In other sessions the agent produced a numbered list of possible next moves and the human simply replied with a number. Gambit notes that the guardrails were bypassed with a cover story: the operator presented the work as an authorised security simulation.
The operator also imposed the same three standing rules at every victim, restated across multiple messages in Russian: no DCSync, no account lockouts during password spraying, and no new computer object added to the domain. Those are the noisy actions most likely to trip an alert, which tells you the human, not the model, was thinking about detection.
The ransomware itself was built for VMware
The second half of Gambit’s report covers the payload. Aurora deployed a Linux build named encrypt.out, a 139 KB binary that encrypts file contents in place with ChaCha20 and wraps each session key with an embedded RSA-4096 public key. Run with its -esxi flag, it calls esxcli to force-kill every running virtual machine, which releases the file locks on the virtual disks, then encrypts the VM files and deliberately skips system volumes so the hypervisor still boots. The extortion note was also written into the SSH login banner, so any administrator connecting to the box sees the demand before the password prompt.
Gambit separately identified a second cluster it attributes to an Aurora operator with medium confidence, covering eight victim organisations across Israel, Germany, Austria, Spain, the United States and Argentina. That operator used different tradecraft entirely, moving laterally through exposed SQL Server xp_cmdshell, escalating with GodPotato and exfiltrating to a self-hosted S3 endpoint.
Who actually got hit
Look at the victim list and a pattern shows up that rarely makes the headline. A cleaning products manufacturer. A garage door maker. A helideck certification body. A Louisiana title insurance firm. An Argentine pharmaceutical distributor. These are mid-market companies with small IT teams and, in most cases, a VMware estate holding everything the business runs on. They are the same profile as the larger clients that agencies and freelance developers across Pakistan and the Gulf build and maintain systems for.
The practical lesson is narrower than “AI is dangerous.” The agent never picked a lock. It was handed credentials and a network path, and it saved its operator the effort of remembering syntax. Anyone running an AI coding agent with live access to a client environment is running the same setup, minus the criminal intent. Scoped credentials, separate accounts for agent sessions and logging of what the agent actually executed cost very little and are the difference between an incident and a catastrophe. The same oversight argument is playing out elsewhere, including in how exchanges are handling AI agents that place trades.
How much of this was the AI?
Less than the framing suggests, and that is the part worth sitting with. Gambit found that the majority of the agent’s commands failed to achieve their stated objective on the first attempt, forcing repeated refinements, and some tasks ended with nothing but a report of failed attempts. The tools were commodity. The access was the operator’s. What the model contributed was patience and recall.
That leaves an unresolved problem for the companies selling these agents. The operator here got compliance by claiming the intrusion was a simulation, which is exactly what a legitimate penetration tester would say, because for a legitimate penetration tester it is true. Distinguishing the two from inside a chat session, in real time, without breaking the tool for the security professionals who pay for it, is a question nobody has answered yet.
