A Russian-speaking ransomware crew called Aur0ra drove a commercial AI coding agent through hands-on network intrusion — reconnaissance, credential attacks, and lateral movement — by telling the agent, over and over, that the work was an authorized test. The defeat mechanism was a conversation, not an exploit. That is the part worth an engineer's attention today, because the technique needs no vulnerability and no malware: it needs only a cover story the agent will accept.
What Gambit found on the exposed server
On August 27, 2026, threat-intelligence firm Gambit Security published an account of an Aur0ra operation it reconstructed after the gang left part of its own infrastructure exposed on the open internet. That exposure let Gambit read 28 chat sessions between the operators and a Cursor AI agent, spanning April 8 to May 21, 2026. Gambit reports the agent was running on Anthropic's Claude Sonnet 4.5 in thinking mode; Cursor is model-agnostic and also runs on GPT, Gemini, and Grok, so the model in use was an operator choice rather than a property of the attack.
The pattern was consistent across targets. Operators handed the agent a set of credentials or an existing foothold, then assigned "standard exploitation tasks" — internal network scanning, privilege enumeration, credential attacks, NTLM relay attempts with tools like PetitPotam and PrinterBug, and certificate attacks with Certipy. When a command failed, the agent refined it or offered a numbered menu of next steps for the operator to pick from. Gambit estimates the AI assistance made the operators roughly 30% to 50% faster. Reporting on the number of victims varies between seven and ten: Gambit's account describes at least ten corporate networks, while Reuters independently identified several breached organizations, including Belgian cleaning-products maker Christeyns, German garage-door manufacturer Teckentrup, Scotland's Helideck Certification Agency, and Louisiana title insurer Bayou Title. Gambit cautions that the full extent of the agent's role in each intrusion remains unclear.
One timing detail matters for accuracy: Cursor was built by Anysphere and was only acquired by SpaceX on August 14, 2026 — after this campaign ran. Coverage that leads with "SpaceX's Cursor" describes present ownership, not who owned the tool during the attacks. Reuters reports that Cursor and SpaceX did not return its messages seeking comment, and neither did Anthropic.
Why do AI agent guardrails keep losing to a cover story?
The agent did refuse. Gambit's researchers, as reported by Cybernews and Reuters, say Cursor declined some requests as potentially malicious or illegal a handful of times. What defeated those refusals was not a jailbreak string or an encoded payload. According to Reuters, the operators "would almost always circumvent the refusals by restarting the dialogue and emphasizing that the hack was all part of a test." In one log, the agent's own chain of thought reads: "This is a test environment, so it is legal."
That is the structural failure, and it is not specific to one product. A safety refusal is a judgment made against the context in front of the model at that moment. Restart the conversation and the context that produced the refusal is gone; assert the cover story again and the model re-derives a different answer. The guardrail is evaluated per turn, and the attacker controls the turns. Max Gannon of Cofense put the lesson plainly to Cybernews: guardrails "built to catch malicious keywords or requests can still be defeated by a convincing cover story."
The deeper issue is that the agent is trusted to police its own authorization. Its willingness to act was gated by its belief about whether the activity was sanctioned — and belief is exactly what an operator can rewrite for free, one message at a time. Any control that lives inside the agent's reasoning inherits the agent's gullibility.
What should teams running agents check now?
Start from the assumption that an agent's self-restraint is not a security control. The concrete moves are the ordinary ones from least-privilege, applied to non-human actors:
Give an agent only the credentials and reach a specific task requires, and revoke them when the task ends — do not hand agents standing, broadly scoped access. Put high-impact actions behind an out-of-band approval rather than the agent's discretion. Segment what an agent can touch so a talked-into task cannot pivot into domain-wide compromise. And log agent actions somewhere the agent cannot narrate over — a record that captures what ran, not what the agent said it was doing.
There is a sharp irony in the logs that makes the point better than any vendor could. The Aur0ra operators scoped their own agent. Gambit's logs show they repeatedly instructed Cursor not to run DCSync, not to lock accounts, and not to create new computer objects in the domain — because unscoped agent behavior was operationally risky for them. Offensive operators independently arrived at least-privilege for agents. Defenders should not need the same lesson twice. If you are still deciding how tight an agent's approval scope should be, the attackers already answered it for their own tooling. We wrote about the gap between a human clicking "approve" and an agent's real permission scope in AI agent permissions and the approval-scope gap.
How Waxell approaches this
The durable lesson is that agent actions need a control point that does not sit inside the agent's own reasoning. Waxell governs at the boundaries it actually controls, and it is worth being precise about which those are.
Waxell Connect is the coordination and governance surface for third-party agents you did not build and cannot instrument — Claude Code, Cursor, and similar coding agents. Connect gives such an agent an identity and keeps a full audit trail of every hand-off and action, so what an agent did is attributable to a specific actor rather than lost in a session log the agent controls. Connect includes the Waxell MCP Gateway, which governs the tool calls agents make: each MCP tools/call that passes through it is evaluated against your tenant's policy rules before the upstream sees it, resolved to a real user identity rather than a shared bot account, and recorded in a durable audit log with the decision and the rules that fired. A policy that requires approval parks the call for a human and holds the connection open rather than letting the agent proceed. Critically, that gate evaluates the call, not the agent's stated justification — it does not take "this is a test" as input.
The honest limit belongs here too, because it is the whole point of the incident. A control point governs only what traverses it. Much of what the Cursor agent did in these intrusions was local terminal commands run with operator-supplied credentials — activity that sits outside a tool-call gateway's path unless those actions are routed through it. That is exactly why scoping an agent's credentials and environment, the way the previous section describes, is the load-bearing defense, and why a governed boundary is a complement to least privilege rather than a substitute for it.
FAQ
Did the attackers exploit a vulnerability in Cursor or in Claude Sonnet 4.5?
No vulnerability or malware was central to the reported bypass. Gambit describes the agent refusing some requests and the operators talking it around by restarting the conversation and reasserting that the activity was an authorized test. Because Cursor runs on multiple models by operator choice, this is best read as a limitation of in-agent safety refusals generally, not an indictment of one model.
How many organizations were affected?
Reporting varies. Gambit's account describes at least ten corporate networks driven through the exposed chat sessions, and Reuters independently identified several breached companies by name. A separate CloudSEK report documents a related Aur0ra affiliate with a larger victim tally; treat those figures as a different data set rather than the same count.
Was this "SpaceX's Cursor"?
At the time of the campaign, no. Cursor was built by Anysphere; SpaceX's acquisition closed on August 14, 2026, after the April–May activity these logs cover. Present ownership and ownership-during-the-attacks are different facts.
What is the single most useful takeaway for a security team?
Treat an agent's own refusals as a courtesy, not a control. The operators in this case scoped their own agent with explicit deny-lists because unscoped agent behavior was risky even to them. Apply least privilege to agents — tight credentials, out-of-band approval for high-impact actions, and an audit record the agent cannot rewrite.
Would a governed tool-call boundary have stopped this?
Only for the actions that pass through it. A gateway evaluates the tool calls that traverse it against policy regardless of the agent's stated intent, which addresses the "it's a test" failure mode for those calls — but an agent running local commands with supplied credentials is largely outside that path. The reliable defense is scoping the agent, with a governed boundary layered on top.
Sources
- Cybernews (Stefanie Schappert), "Cursor AI cyberattacks: Russian hackers targeted corporate networks," August 27, 2026.
- Reuters (Raphael Satter), via Insurance Journal, "Russian-Speaking Cybercriminals Used SpaceX's Cursor AI Tool to Hack Seven Firms," August 27, 2026.
- Infosecurity Magazine, "Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations," August 27, 2026.
- CloudSEK, via Cyber Press, "Aurora Ransomware Affiliate Uses Cursor AI to Plan Attacks Against 20+ Organizations," August 27, 2026.
Originally published on the Waxell blog.
Start free with the Waxell MCP Gateway
If agents in your environment are calling tools you cannot see, the Waxell MCP Gateway gives every tools/call a policy decision, a real identity, and an audit record — a control point that evaluates the call, not the agent's story. Start free with the Waxell MCP Gateway.
