Cursor AI Agent Weaponized by Ransomware Gang: 10 Multinational Enterprises Breached
Between April and May 2026, the Aurora ransomware gang used the AI Agent built into Cursor IDE (running claude-4.5-sonnet-thinking) to conduct targeted cyber intrusions against 10 enterprises across 9 countries. Security firms Gambit Security and CloudSEK independently documented the attack chain, revealing how commercial AI coding tools are being repurposed for active offensive operations.