Overview
- Reuters reported on Aug. 27 that Gambit Security found 28 chat sessions on an Aur0ra server showing Russian‑speaking hackers using a Cursor AI agent to speed intrusions earlier this year.
- The logs show attackers told the agent the work was a 'simulation' and often restarted conversations to bypass refusals, and the agent gave instructions for credential theft, VPN access, and using known exploit tools.
- Reuters reviewed the chats and identified six named victims, including Belgian cleaner Christeyns, German maker Teckentrup, Scotland’s Helideck Certification Agency, an Argentine pharma distributor, an Italian manufacturer, and Bayou Title in Louisiana.
- Cisco Talos’ August analysis of exposed prompt logs found broad misuse of Cursor and other coding assistants to prototype malware and probe vulnerabilities, and it warned that available evidence does not verify Cursor’s role in every alleged breach.
- SpaceX closed its acquisition of Cursor’s parent company in mid‑August and security researchers say the episode raises urgent needs for stricter agent guardrails, vetted extensions, and detailed logging to slow AI‑assisted attacks.