The Ransomware Crew Told Cursor It Was a Penetration Test. Cursor Believed It.

The most consequential thing the Aur0ra operator typed into Cursor was not a command. It was a cover story.

Israeli security startup Gambit Security recovered 28 chat sessions from a server the ransomware crew had left exposed to the open internet, and published its findings Thursday alongside a separate report from Singapore-based CloudSEK. Reuters reviewed portions of the same data, which was still online as of last month. The logs run from April 8 to May 21 and show a Russian-speaking operator using the AI agent inside Cursor to help break into seven companies. Each time the agent balked at a request it judged harmful or illegal, the operator restarted the dialogue and stressed that the work was authorised security testing. It almost always worked.

Gambit says the agent's own chain of thought caught the pretext landing in real time. "This is a test environment, so it is legal," the model told itself, according to one of the recovered logs.

That sentence is the whole story, and it is worth being exact about what the story is not. Nothing here was autonomous. There was no self-directing worm. There was a human criminal with commodity intrusion tooling and a chat window, who defeated a safety layer with one line of social engineering and then worked measurably faster than he otherwise would have. That distinction will get blurred in most coverage. It should not be.

What the logs show

Gambit named no victims. Reuters identified six of the seven independently: Ghent-based hygiene and cleaning products maker Christeyns, German garage-door manufacturer Teckentrup, Scotland's Helideck Certification Agency, which vets helicopter landing sites, an Argentine pharmaceutical distributor, an Italian manufacturer, and Bayou Title, which bills itself as Louisiana's largest title insurance company. None responded to requests for comment. Bayou Title later appeared on Aur0ra's leak site, which usually means a ransom demand failed.

Across the sessions, Gambit counted hundreds of malicious operations: credential theft, internal network mapping, coerced authentication, attempts at high-value account takeover. The agent's tone throughout is the ordinary register of a coding assistant. "Great! VPN connected successfully!" it wrote after the Argentine company was breached. Told of a vulnerable machine inside Teckentrup's network, it rated the odds of an exploit working: "Chance of success: VERY HIGH."

Two caveats deserve more prominence than they will get. Reuters could not independently establish how much the agent actually contributed to any given break-in, or whether every intrusion ended in data theft and extortion. And Gambit says the agent was running Anthropic's Claude Sonnet 4.5, a mid-tier model rather than one of the frontier systems whose offensive capability has drawn attention in Washington.

Anthropic did not return a request for comment. Neither did Cursor nor SpaceX, which closed its 60-billion-dollar all-stock acquisition of Cursor's parent Anysphere on August 14 and folded it into a division now branded SpaceXAI.

A number worth interrogating

Eyal Sela, Gambit's director of threat intelligence, put the advantage in plain terms. The agent "probably helps them get 30, 40, 50 percent faster because it helps them skip over all the things they'd have to do manually," he said.

Treat that as an experienced analyst's read of a transcript, not a measurement. But the direction is consistent with CloudSEK's wider picture, drawn from the same exposed directory: a single affiliate hitting more than twenty organisations across nine countries between April and July, reaching domain-level or interactive access at seventeen of them, with only four ever surfacing on a public leak site. CloudSEK found the operator drafting attack plans in Russian, and never once touching Russian or other CIS-country targets.

The tooling was unremarkable. Publicly documented, freely available, the same kit any penetration tester carries. What was new was the interface.

The problem nobody has solved

Here is the uncomfortable part. A penetration test and a criminal intrusion are behaviourally identical. Same reconnaissance, same credential handling, same privilege escalation, same lateral movement. The only difference is a signed engagement letter sitting in a filing cabinet somewhere, and the model provider cannot see it.

Every available remedy is weak. Authorisation attestation means asking the user to assert they have permission, which is precisely what the Aur0ra operator did, for free, in a sentence. Customer verification cuts directly against self-serve distribution: Cursor became a multi-billion-dollar business by letting anyone sign up in under a minute. Behavioural monitoring hits the same wall, because the behaviour is legitimate for a large, paying constituency of security professionals, and flagging it means inspecting customer sessions, which enterprises buying coding assistants have strong opinions about.

This is also not a novel failure. Anthropic disclosed in November that a Chinese state-linked group it tracked as GTG-1002 had used role-play prompting to convince Claude Code it was conducting a sanctioned penetration test, then automated the bulk of intrusion work across roughly thirty targets. Same pretext, different actor, months earlier. The industry has now watched the identical bypass succeed twice in public, and no vendor has shipped a durable answer.

Curtis Simpson, Gambit's chief strategy officer, framed it as an arms race. "This is going to be a cat-and-mouse game," he said. On AI-assisted intrusion generally: "We'll see more and more of this all the time."

What to watch

Whether SpaceX says anything at all. A company that now owns Cursor, holds national-security launch contracts, and declined to comment on documented criminal misuse of its newest product is making a choice that will be noticed in Washington.

Whether any vendor moves from asking about authorisation to verifying it. Scoped engagement records, verified-organisation tiers for offensive security work, anything at all that attaches a cost to lying. Right now the pretext is free.

And whether the 30-to-50-percent figure survives contact with real data. If AI assistance genuinely compresses intrusion timelines by a third, defenders' detection windows shrink by the same proportion, and every assumption about dwell time baked into incident response quietly gets worse. That, rather than the fiction of an autonomous attacker, is the finding worth being alarmed about.