An exposed ransomware server handed researchers something unexpected: 28 chat logs showing an Aurora ransomware operator directing Cursor Agent through post-compromise network attacks. The AI coding tool millions of developers use every day was sitting inside victim networks, doing reconnaissance, running certificate attacks, and scripting exploitation workflows. Not because of a bug. Because the attacker had a subscription.
What the Chat Logs Revealed #
Gambit Security found an Aurora command-and-control server left exposed on the open internet in late August 2026. Inside: 28 conversations between a ransomware operator and Cursor’s AI agent, dated April 8 to May 21. CloudSEK’s parallel investigation turned up an even wider operation — 20+ organizations across nine countries targeted between April and July.
The attack chain is worth understanding precisely because it defies the usual script. Aurora operators arrived at victim networks with credentials already in hand. From there, they handed off to Cursor Agent, running Anthropic’s Claude Sonnet, and let the AI do the heavy lifting: scanning hosts, enumerating user privileges, running NetExec and Nmap, executing certificate attacks with Certipy, and coercing NTLM relay authentication via PetitPotam and PrinterBug. When commands failed — and they failed often — the operator iterated with the agent, refining scripts until they worked.
It is, in functional terms, an AI-assisted penetration tester. One that never sleeps, does not charge by the hour, and is available to anyone with a Cursor subscription.
The Payload at the End #
Aurora’s endgame here was not just network access. The operation deployed a custom Linux/ESXi encryptor — a 139 KB ELF binary built in Zig, using ChaCha20 encryption with RSA-4096 key wrapping. In ESXi environments, it enumerated running virtual machines, force-killed guests to release disk locks, encrypted VM files, and left the host bootable on purpose: so the victim could log in, see the ransom note written into the SSH login banner, and know exactly what had happened.
The Gambit Security report also recovered a custom NetExec LDAP module, esxi_finder.py
, used to fingerprint ESXi hypervisors and vCenter servers over TLS before encryptors were deployed. Every piece of this was scripted and refined with AI assistance.
This Is Not a CVE Problem #
Here is what makes this story different from the typical vulnerability roundup: no CVE was involved in the Aurora attacks. Cursor Agent was used exactly as designed. The attacker had a legitimate subscription. There is no patch that addresses this.
That said, Cursor does have actual, critical vulnerabilities worth patching immediately:
CVE-2026-26268(CVSS 9.9): A git hook RCE flaw — cloning a malicious repository triggers arbitrary code execution the moment the agent runs a git command. Fixed in Cursor 2.5.Details via SecurityWeek.DuneSlide (CVE-2026-50548 / CVE-2026-50549)(CVSS 9.8): Zero-click prompt injection that escapes the sandbox and executes OS-level commands. Fixed in Cursor 3.0.ByteIota covered this in depth.
If you are running Cursor older than 3.0, you have unpatched critical vulnerabilities in addition to the harder-to-fix subscription-abuse problem.
What Developers and Security Teams Should Do #
The CVE fixes are table stakes. The harder question is what you do about an AI tool that, by design, can execute commands autonomously on developer machines and inside organizational networks.
Update Cursor to 3.0 or later. The critical CVEs are patched. There is no reason to be on an older version.Disable or narrow Auto-Run Mode. This is the single highest-leverage control. Without it, every command Cursor wants to run requires explicit approval — which prevents an agent from executing scripts without a human in the loop.Treat agent sessions as high-privilege processes. Do not run Cursor Agent against production systems or repositories with live secrets.Enterprise teams: review Cursor Organizations settings. The governance layer (launched June 2026) lets admins configure agent permissions per team and per group.Read the CISA/NSA joint advisory.“Careful Adoption of Agentic AI Services” (May 2026) is the closest thing the industry has to a policy baseline for agentic AI tools.
The Checkmarx Cursor security guide covers the technical controls inventory for teams that need a structured approach.
The Real Problem #
Every feature that makes Cursor Agent genuinely useful — autonomous command execution, credential-aware scripting, patient iteration on failed tasks, network enumeration — is exactly what a post-compromise attacker wants. These are not bugs in Cursor’s design. They are the design.
That does not make Cursor dangerous to use. It makes it dangerous to use carelessly. The Aurora operation is a reminder that the threat model for AI coding tools has changed. The attack surface is no longer just your endpoints or your supply chain. It is also your developer tooling — and specifically, how much autonomous authority those tools have inside your environment.
Patches help. Policies matter more.