Russian Hackers Used Cursor AI to Breach Seven Companies

Russian-speaking hackers used the AI coding assistant Cursor to help breach at least seven companies earlier this year, according to a cybersecurity report and a Reuters investigation. The campaign, attributed to a ransomware group called Aurora, demonstrates how commercial AI tools are being repurposed to accelerate cyberattacks.

The activity was uncovered after Gambit Security, a Tel Aviv-based cybersecurity firm, discovered an Aurora server left exposed on the internet. This access provided researchers with 28 chat logs from April 8 to May 21, showing interactions between the hackers and Cursor's AI agent. The agent was powered by Anthropic's Claude Sonnet 4.5 model.

According to the logs, the hackers initially told the AI their actions were part of an authorized security test or simulation. When the agent refused certain requests as potentially harmful, the operators would restart the chat and reiterate the cover story. In one instance, the AI's own reasoning accepted the explanation, stating, "This is a test environment, so it is legal."

The hackers had already gained initial access to some networks before using the AI. They provided the agent with credentials or an existing...