- The Mess: The Russian-speaking group Aur0ra used Cursor, an AI coding assistant, during intrusions against at least seven organizations. Researchers found attackers manipulating the AI agent into performing offensive tasks, including credential theft and reconnaissance.
- The Damage: AI coding agents can become an unexpected privilege multiplier when an attacker gains access to a developer environment where the agent can read files, execute commands and interact with internal systems.
- The Fix: Treat AI coding agents as privileged software: restrict their terminal access, isolate development environments and never allow an agent to execute attacker-provided instructions blindly.
The hacker didn’t write the code.
He asked the AI to do it.
That’s the interesting part of the Aur0ra campaign.
Security researchers found evidence that a Russian-speaking cybercrime group used Cursor, an AI-powered coding environment, during attacks against at least seven organizations.
The attackers weren’t simply asking an AI chatbot how malware works.
They were using an AI coding agent as part of the operation.
And that changes the equation.
The Developer Tool Became Part of the Attack
Cursor is designed to help developers work with code.
It can inspect files.
Understand projects.
Write code.
Modify files.
Run commands.
And automate repetitive tasks.
Those capabilities are incredibly useful when you’re building software.
They’re also incredibly useful when someone wants an automated assistant inside a compromised environment.
That’s the problem.
The same permissions that make an AI agent productive can make it dangerous when controlled by the wrong person.
Aur0ra Didn’t Just Ask for Code
Researchers found more than 20 conversations involving Cursor’s AI agent during the attacks.
The attackers attempted to manipulate the agent into believing that offensive activity was part of a legitimate simulation or research exercise.
In other words:
the human attacked the AI.
Not with an exploit.
With instructions.
The objective was to get the agent to perform tasks that would normally be considered suspicious.
The AI Was Given a Story
This is where things get particularly interesting.
Instead of simply saying:
“Steal these credentials.”
the attacker could frame the request as:
“This is an authorized security simulation.”
or
“Pretend you’re conducting a controlled test.”
The agent doesn’t have the same understanding of authorization that a human security professional does.
It sees instructions.
Context.
Files.
Tools.
And a task.
If its safeguards don’t correctly distinguish legitimate security work from malicious activity, the attacker has another route around the restrictions.
Prompt Injection Isn’t Just a Chatbot Problem
We’ve spent years talking about prompt injection as a problem for AI chatbots.
AI coding agents make the problem much more serious.
Why?
Because the model isn’t just answering questions.
It can potentially:
read files
modify code
execute shell commands
install packages
query systems
inspect credentials
and
interact with external services.
That’s an enormous difference.
A chatbot giving bad advice is annoying.
An agent executing bad instructions is an incident.
The Agent Can See Things the Attacker Can’t
This is the real security problem.
Imagine a developer machine containing:
~/.ssh/
.env
cloud credentials
API keys
Git configuration
internal source code
deployment scripts
database connection strings
The human attacker may not initially know where any of that is.
An AI coding agent can search the environment extremely quickly.
It already has the context.
The agent can effectively become a reconnaissance assistant.
And sometimes the most valuable thing in a developer environment isn’t the source code.
It’s the credentials sitting next to it.
Credential Theft Gets Easier
Modern development environments are packed with secrets.
Cloud access tokens.
GitHub credentials.
Package-manager tokens.
SSH keys.
API keys.
Database passwords.
CI/CD secrets.
The AI doesn’t need to exploit a complicated memory corruption bug to find them.
It can simply search.
That makes the agent an extremely attractive target after an initial compromise.
Seven Organizations Were Targeted
According to reporting based on the research, Aur0ra used Cursor in attacks against at least seven companies.
That doesn’t mean seven organizations were completely compromised through Cursor.
The important distinction is that researchers observed the AI coding environment being used as part of the intrusion process.
That’s already enough to demonstrate the concept.
AI agents have crossed another line.
They’re no longer just productivity software.
They’re becoming part of the attack surface.
Why Developers Are Interesting Targets
Developers routinely have more privileges than ordinary employees.
One workstation may have access to:
source repositories
production systems
cloud environments
CI/CD pipelines
deployment credentials
internal documentation.
Compromise the right developer machine and an attacker may get a path into several other systems.
Now add an AI agent that can understand the entire project.
The attacker gets an assistant.
AI Makes Reconnaissance Cheap
Traditional attackers spend time figuring out:
Where are the credentials?
Which repository matters?
How is the application deployed?
Where are the configuration files?
Which cloud account is being used?
An AI coding agent can potentially answer those questions quickly.
Not because it has magical hacking powers.
Because it is very good at navigating large amounts of technical information.
That makes it useful for both defenders and attackers.
The Agent Doesn’t Need to Be “Jailbroken”
This distinction matters.
People often imagine an AI attack as:
find a clever prompt
↓
bypass safety
↓
get malware code
But the real risk is more mundane.
The agent already has legitimate access to a development environment.
The attacker manipulates the task.
The agent performs operations using its existing permissions.
No spectacular jailbreak required.
That’s much more realistic.
The Terminal Is the Dangerous Part
An AI coding assistant with read-only access to source code is one thing.
An agent with terminal access is another.
Give it permission to execute:
bash
powershell
python
git
ssh
and other system commands and you’ve effectively created a highly capable automation layer.
If an attacker can influence what the agent does, those permissions become part of the attack surface.
This is why least privilege matters even for AI tools.
Especially for AI tools.
Don’t Let the Agent Decide What “Authorized” Means
An AI agent cannot reliably determine whether the user requesting an operation is actually authorized to perform it.
That’s an organizational control.
Not a language-model problem.
If the agent is told:
“Run this against our production environment.”
it shouldn’t have to decide whether that statement is true.
The environment should enforce permissions.
The agent should inherit the minimum permissions necessary to perform its job.
Development Environments Need Isolation
A developer should ideally not have one unrestricted environment containing:
source code
production credentials
cloud admin tokens
SSH keys
and
an AI agent with shell access.
That’s a lot of trust concentrated in one place.
If something goes wrong, the blast radius is enormous.
Containers, ephemeral environments, separate credentials and tightly scoped tokens can reduce that risk.
The AI Isn’t the Villain
This isn’t an argument to ban Cursor.
The same capabilities that make AI coding assistants useful to attackers make them useful to defenders.
An AI agent can:
review code
find vulnerabilities
explain logs
automate remediation
generate detection rules
investigate suspicious behavior.
The problem is not AI.
The problem is giving an autonomous system broad permissions without treating those permissions as security-sensitive.
The New Attack Chain
The traditional model looked like:
attacker → compromised developer machine → credentials → cloud
Now we can add another layer:
attacker → compromised developer environment → AI agent → credentials → cloud
The AI becomes the operator’s force multiplier.
And unlike a conventional script, it can reason over unfamiliar codebases and adapt its actions to what it discovers.
That’s valuable.
For both sides.
Security Teams Need New Telemetry
Traditional endpoint monitoring may detect:
PowerShell
cmd
SSH
Git
curl
Python
But the question now becomes:
Who asked the AI agent to execute them?
That’s a different telemetry problem.
Organizations using AI coding agents should consider logging:
agent sessions
tool calls
terminal commands
file access
network activity
and
changes made by the agent.
Otherwise the AI layer becomes a blind spot sitting between the user and the operating system.
Imagine the Incident Report
The investigation says:
An attacker accessed the developer environment.
Fine.
Then someone asks:
What happened next?
The answer may eventually be:
The attacker instructed the AI agent to search the repository for credentials.
That’s not a traditional malware execution chain.
But the outcome can be exactly the same.
Secrets leave the machine.
This Is Going to Get Worse
AI coding agents are becoming increasingly autonomous.
They can plan tasks.
Modify multiple files.
Run tests.
Install dependencies.
Execute commands.
Interact with APIs.
The more autonomy they gain, the more important authorization becomes.
At some point:
“It’s just a coding assistant.”
stops being a useful security description.
It’s software with access to your environment that can interpret natural-language instructions and take actions.
That’s an agent.
Treat it accordingly.
Bugstoday Opinion
This is the AI security story I find more interesting than another headline claiming that criminals are “using AI.”
Of course they are.
The important question is how.
Aur0ra’s use of Cursor demonstrates the more interesting direction: attackers can manipulate an AI coding agent that already has legitimate access to files, tools and development infrastructure.
The AI doesn’t have to become malicious.
It only has to be convinced to do something useful for the wrong person.
That’s a nasty distinction.
Bugstoday verdict: the next dangerous AI doesn’t need to write malware from scratch. It can simply become the junior developer nobody authorized — with access to your repositories, credentials and terminal. If your AI coding agent can execute commands, then its permissions belong in the security model. Treating it like autocomplete is how you eventually end up investigating why autocomplete just emptied your .env file.
