Russian Hackers Used Cursor AI to Breach Seven Companies

Russian-speaking hackers used the AI coding assistant Cursor to help breach at least seven companies earlier this year, according to a cybersecurity report and a Reuters investigation. The campaign, attributed to a ransomware group called Aurora, demonstrates how commercial AI tools are being repurposed to accelerate cyberattacks. The activity was uncovered after Gambit Security, a Tel Aviv-based cybersecurity firm, discovered an Aurora server left exposed on the internet. This access provided researchers with 28 chat logs from April 8 to May 21, showing interactions between the hackers and Cursor's AI agent. The agent was powered by Anthropic's Claude Sonnet 4.5 model.