Hackers used an AI coding tool to breach seven companies

A Russian-speaking ransomware group used Cursor, a commercial AI coding tool, to help breach at least seven companies this spring, according to a report from the security research firm Gambit Security that Reuters reviewed and independently corroborated in part.

Gambit said it found the campaign after discovering a server that the group, which calls itself Aur0ra, had accidentally left exposed to the open internet. The server held 28 chat sessions between the hackers and Cursor's AI agent, spanning April 8 to May 21, which Gambit says show the tool being used to help plan intrusions and escalate access inside compromised networks.

Reuters said it independently verified six of the victims: Christeyns, a Belgian maker of hygiene and cleaning products; Teckentrup, a German garage door manufacturer; the Helideck Certification Agency, a Scotland-based firm that certifies helicopter landing sites; an Argentine pharmaceutical distributor; an Italian manufacturer; and Bayou Title, which describes itself as Louisiana's largest title insurance company. Bayou Title later turned up on Aur0ra's own data-leak site, which typically means the group tried to extort a ransom and failed to collect.

Gambit's Eyal Sela said the AI tool likely made the hackers meaningfully faster rather than more capable: it "probably helps them get 30, 40, 50 percent faster because it helps them skip over all the things they'd have to do manually." His colleague Curtis Simpson called the pattern the start of a prolonged standoff: "This is going to be a cat-and-mouse game," as AI providers tighten safeguards and attackers keep finding ways around them.

Cursor is made by Anysphere, the startup behind the coding assistant; SpaceX agreed in June to acquire Anysphere in an all-stock deal reported at a $60 billion valuation, though the deal was still pending regulatory approval and had not closed when the attacks described here took place. The episode is the latest in a run of incidents this year in which commercial AI coding tools built for legitimate work have been repurposed for intrusions, underscoring that AI labs cannot fully separate a tool's productivity gains from what it hands to whoever is using it, criminal or not.