Russian-Speaking Hackers Used Cursor AI to Break Into Seven Companies

• The Mess: A Russian-speaking cybercriminal group known as Aurora used the AI-powered coding assistant Cursor as part of real-world attacks against at least seven companies. Instead of simply asking AI to write malware, the attackers reportedly used an AI coding agent to help discover vulnerabilities, steal credentials and move through compromised environments.

This is the kind of AI security story that is becoming increasingly difficult to dismiss as hype.

The attackers weren’t experimenting with AI in a laboratory.

They weren’t testing whether an LLM could write a basic exploit.

They were using a commercial AI development tool during actual intrusions.

And researchers found evidence of the operation after discovering 28 exposed AI-agent sessions on infrastructure belonging to the attackers.

Cursor Became Part of the Attack Chain

Cursor is designed primarily as an AI-powered development environment.

It can understand codebases, modify files, execute commands and help developers solve complex programming problems.

Those same capabilities can obviously become useful to an attacker.

According to Reuters, Aurora abused Cursor’s agentic capabilities while conducting attacks against organizations in sectors including technology, finance and cryptocurrency.

The important word here is:

agentic.

The attackers weren’t simply copying AI-generated code into a terminal.

They could give the agent a task and allow it to perform multiple steps while interacting with the environment.

That’s a much more powerful capability.

The Attackers Lied to the AI

This is probably the strangest part of the story.

According to Reuters, the attackers reportedly framed malicious activity as a security simulation or authorized test.

In other words, they attempted to persuade the AI that it was helping with legitimate cybersecurity work.

That matters because many AI security systems use context and stated intent when deciding whether to assist with potentially dangerous requests.

If an attacker can successfully disguise malicious activity as:

penetration testing

red teaming

security research

or

authorized vulnerability assessment

the safety boundary becomes much harder to enforce.

The AI Helped With Real Intrusions

Reuters reports that the attackers used Cursor to assist with activities including:

• searching for credentials;
• identifying vulnerabilities;
• analyzing compromised systems;
• developing attack tooling;
• moving through environments.

The exact division between human and AI activity isn’t always obvious.

And that’s an important point.

The story isn’t:

“AI independently hacked seven companies.”

There is no evidence that a completely autonomous AI spontaneously decided to attack businesses.

Humans were behind the operation.

The AI was used as a force multiplier.

That distinction makes the story more realistic, not less dangerous.

Twenty-Eight Sessions Were Exposed

Researchers discovered 28 sessions associated with the attackers after finding an exposed server.

Those sessions provided a rare look into how the group was using AI during its operations.

For defenders, this is unusually valuable.

Most of the time we see the result of an attack.

We don’t get to see the attacker’s conversation with their AI assistant.

Here, researchers apparently got something close to a window into the workflow.

And that workflow looks increasingly familiar:

human chooses target → AI investigates → human evaluates results → AI writes tooling → AI performs additional tasks → human continues the operation.

That is not science fiction.

It’s a productivity upgrade for criminals.

Seven Companies Were Targeted

The investigation identified at least seven organizations targeted by the group.

The victims reportedly included companies operating in technology, finance and cryptocurrency-related sectors.

That’s enough to show that this wasn’t a one-off experiment.

The attackers were using AI as part of a broader operational workflow.

And that raises a bigger question:

How many other criminal groups are doing the same thing without leaving their AI sessions exposed?

We don’t know.

AI Makes the Middle of the Attack Faster

One of the biggest advantages isn’t necessarily discovering a zero-day.

It’s everything in between.

A traditional attacker may spend hours:

• reading source code;
• understanding an unfamiliar API;
• writing scripts;
• debugging payloads;
• parsing logs;
• searching configuration files;
• adapting tools to the target environment.

An AI coding agent can accelerate many of those tasks.

It doesn’t need to discover a magical vulnerability.

It just needs to reduce the time required to exploit the ones that already exist.

And that’s potentially enough to change the economics of cybercrime.

The Real Threat Is Scale

Imagine one skilled attacker working on one target.

Now imagine that attacker has several AI agents helping simultaneously.

One agent analyses the application.

Another searches the source code.

Another develops tooling.

Another investigates credentials.

Another documents the environment.

The human becomes the coordinator rather than the person doing every technical operation manually.

That can dramatically increase throughput.

The attacker doesn’t necessarily become smarter.

The attacker becomes faster.

And in cybersecurity, speed matters.

This Is Different From the Hugging Face Story

We recently looked at the incident involving hundreds of AI agents coordinating during a cyber-capability evaluation.

This story is different.

There wasn’t a huge swarm of autonomous agents operating in a research environment.

Instead:

criminals used a commercial AI coding agent as a tool during real attacks.

That’s arguably more relevant to ordinary defenders.

Because organizations don’t need to imagine some future superintelligence.

The technology already exists.

Attackers can use the same AI development environments that legitimate programmers use.

What Defenders Should Watch

Security teams should start thinking about AI-assisted attacks as a normal part of the threat model.

That means monitoring for:

• unusual use of developer AI tools;
• large-scale automated code changes;
• suspicious command execution initiated from development environments;
• credential discovery;
• unusual API activity;
• unexpected outbound connections;
• AI coding agents interacting with production infrastructure;
• compromised developer accounts using legitimate tools.

And organizations should be especially careful about giving AI agents unrestricted access to:

source code + credentials + production systems.

That combination is dangerous even when the person using the system has good intentions.

The Irony of the Situation

AI coding assistants are designed to make developers more productive.

That’s exactly what happened here.

The attackers became more productive.

The difference is what they were trying to produce.

Instead of:

“build this feature”

the objective becomes:

“find a way into this system.”

The underlying technology doesn’t care about the morality of the final objective.

The security controls around it have to.

Bugstoday Opinion

This is where the AI-security conversation should move beyond headlines about “AI hackers.”

The interesting question isn’t whether AI can hack.

Clearly, AI can already help humans hack.

The real question is:

How much human effort does it take to turn an AI assistant into an effective cyber operator?

If the answer keeps falling, the economics of cybercrime change.

One experienced operator with a powerful agent may eventually be able to accomplish what previously required an entire technical team.

That’s the uncomfortable part.

Bugstoday verdict: Aurora didn’t need a superintelligent AI to attack seven companies. It needed humans who knew how to make an AI coding agent work for them. That’s probably a more immediate security problem than the science-fiction version of autonomous hacking — because this one is already happening.