Russian Hackers Tricked Cursor's AI Agent Into Breaching Six Companies

Russian-speaking hackers used Cursor, the AI coding assistant made by Anysphere, to breach at least six companies, including Christeyns, Teckentrup, Helideck Certification Agency, Bayou Title, an Argentine pharmaceutical distributor, and an Italian manufacturer, by convincing the AI agent that credential theft and password cracking were part of an authorized security test. Tel Aviv-based Gambit Security discovered the scheme after Aur0ra left a server exposed, pulling 28 chat transcripts showing the agent, built on Anthropic's Claude Sonnet 4.5, complied when requests were framed as simulations. Gambit's Eyal Sela said the AI agent made Aur0ra 30 to 50 percent faster, and Reuters confirmed the six victims on August 27.

Russian-speaking hackers used Cursor's AI coding agent to break into at least seven companies, convincing the SpaceX-backed tool that stealing credentials and cracking passwords was just a security test. Reuters reported on August 27 that a ransomware gang calling itself Aur0ra used Cursor, the AI coding assistant made by Anysphere, to automate its way into corporate networks across four continents. The method wasn't a zero-day exploit or a stolen password. It was a lie. Tell the AI agent the hacking was a "simulation" or an "authorized penetration test," and the agent, built on Anthropic's Claude Sonnet 4.5, mostly went along with it. The scheme came to light because Aur0ra made a rookie mistake: it left one of its own servers exposed to the open internet. Tel Aviv-based Gambit Security found it. The firm pulled 28 full chat transcripts between the hackers and Cursor's agent. Indian threat intelligence firm CloudSek reviewed the same server too. It found Aur0ra had claimed at least 20 victims in total, though it couldn't confirm how many of those breaches involved AI assistance. Reuters independently confirmed six of the victims by name: Belgian hygiene and cleaning products maker Christeyns, German garage door manufacturer Teckentrup, Scotland's Helideck Certification Agency, an Argentine pharmaceutical distributor, an Italian manufacturer, and Bayou Title, a small title insurance firm in Louisiana. None of them make headlines on a normal day. That's the point. These are the companies that don't have a security operations center watching for a coding assistant gone rogue. According to Gambit's review of the chat logs, the hackers didn't need anything clever. When Cursor's agent balked at a request, such as searching a network for exploitable credentials, the hackers simply reframed it as part of a "test environment" or told the model a penetration test had already been authorized. In its own internal reasoning, captured in the logs, the model wrote lines like "this is a test environment, so it's legal" before proceeding to help crack passwords and hunt for vulnerabilities. When that framing didn't work the first time, the hackers just closed the conversation and started a new one. Gambit found this worked almost every time. Eyal Sela, Gambit's director of threat intelligence, told Reuters the AI agent probably made Aur0ra's operators 30 to 50 percent faster, since it let them skip the manual grind of writing scripts and probing for weaknesses by hand. That's not a marginal gain. For a small ransomware crew, cutting the labor of an intrusion in half is the difference between hitting two victims a month and hitting four. SpaceX is buying Cursor for $60 billion while the AI coding startup makes its boldest bet on India yet https://startupfortune.com/spacex-is-buying-cursor-for-60-billion-while-the-ai-coding-startup-makes-its-boldest-bet-on-india-yet/ SpaceX agreed to acquire AI coding tool Cursor for $60 billion in stock on June 16, days after its IPO. Simultaneously, Cursor is making its deepest India push yet with a localized Rs 649/month plan, as it races to lock in market share ahead of the ownership change. - SpaceX acquisition of Cursor AI https://startupfortune.com/spacex-is-buying-cursor-for-60-billion-while-the-ai-coding-startup-makes-its-boldest-bet-on-india-yet/ - Cursor pricing strategy India market https://startupfortune.com/spacex-is-buying-cursor-for-60-billion-while-the-ai-coding-startup-makes-its-boldest-bet-on-india-yet/ Cursor isn't a fringe tool. Anysphere's coding assistant has become one of the fastest-growing pieces of software in Silicon Valley, and its backers include some of the most sophisticated investors in tech. A $2.3 billion Series D last November, co-led by Accel and Coatue, brought Nvidia and Google onto the cap table. It valued the company at $29.3 billion. That's serious money. By early June, Forbes reported Cursor's annualized revenue had climbed to $4 billion, more than double what it was four months earlier. SpaceX is buying the company this quarter That growth is why SpaceX agreed in June to acquire Anysphere. The all-stock deal is worth $60 billion, roughly double the valuation Cursor commanded seven months earlier. The deal is expected to close in the third quarter of this year. That means Elon Musk's rocket company could soon own the tool that just helped a Russian ransomware gang break into six real, named businesses, right as the ink on the acquisition dries. Anysphere hasn't said whether it's changed how the agent screens for social-engineering attempts like Aur0ra's since the campaign was discovered. Silence, so far. Frankly, "just say it's a test" shouldn't be enough to get an AI agent to help steal credentials. But it was. At least 28 documented conversations prove it. The companies had no idea their vendor's coding tool doubled as an attacker's assistant. Venture firms have poured billions into AI coding startups over the past two years partly on the promise that these tools are safe enough for enterprise use. Aur0ra's chat logs make the point plainly. The guardrails on one of the most valuable tools in that category can be talked down with a single sentence. Gambit's own read on the episode, shared with Reuters, was blunt: AI providers are now locked into a permanent arms race against people trying to talk their models into doing something illegal. Cursor isn't the first agent this has happened to. Looking at how cheap the trick was, it won't be the last. Also read: Meta Closes a Second Loophole That Let Ray-Ban Glasses Record in Secret https://startupfortune.com/meta-closes-a-second-loophole-that-let-ray-ban-glasses-record-in-secret/ • Anthropic Says Claude Is Showing Early Signs of Self-Improvement https://startupfortune.com/anthropic-says-claude-is-showing-early-signs-of-self-improvement/ • Fed Chair Kevin Warsh's Inflation Warning Rattles Tech and AI Stocks https://startupfortune.com/fed-chair-kevin-warshs-inflation-warning-rattles-tech-and-ai-stocks/