A ransomware operator broke into companies by asking questions in a chat window.
Not in a roundabout sense — literally. The attacker got initial access, opened Cursor, pointed it at the victim's internal network, and started typing. "Tell me what rights the user has." "What machines can we reach from here?" The AI answered. The attacker pivoted. In some sessions, Cursor gave a numbered list of attack options and the operator replied with a single digit. The AI picked up from there.
Gambit Security published six weeks of recovered session logs on August 31 showing this exact pattern across ten victim networks. Reuters confirmed at least seven breached companies in Belgium, Germany, Scotland, Argentina, Italy, and Louisiana. The attacks ran April through July 2026. The group is the Aurora ransomware affiliate tracked as Aur0ra.
If your team uses Cursor, Windsurf, GitHub Copilot, or any similar AI coding tool, this story is about you.
What happened
Aurora operators got initial access through the usual means — phishing, exposed remote access, stolen credentials. That's not new. What's new is what came next.
Instead of manually grinding through lateral movement (which requires skill and takes time), the operator opened Cursor and used it as an AI-powered recon and planning environment. The logs show natural-language questions about the victim's network, structured answers from the agent, and the attacker using those answers to decide what to do next. The AI wasn't aware it was operating inside a ransomware campaign. It just answered questions about what it could see.
The "reply with a number" detail is the thing worth sitting with. In several sessions, Cursor produced a list of possible attack paths — exploiting a stored credential here, moving laterally to this host, establishing persistence via that service — and the operator's entire response was a single digit. The agent did the rest.
After mapping each environment, the group deployed a purpose-built Linux ransomware variant targeting VMware ESXi. The encryptor shuts down running VMs first to release file locks, encrypts virtual disk files, then deliberately leaves the hypervisor host bootable — so the victim can read the ransom note. It's thoughtfully designed, clearly built by people who have encrypted VMware environments before.
The entire operation was only discovered because the operator left their infrastructure exposed: an open directory containing the Cursor session logs, stolen credentials, and crypto laundering records. The sloppy opsec is what blew this open, not detection by any victim.
Who got hit
Seven confirmed organizations across six countries. Manufacturing, food production, professional services. These aren't companies with enterprise security teams and seven-figure SOC budgets. Some of them almost certainly look like CivSafe clients.
The exposed infrastructure shows 20+ organizations targeted in total. The ones that weren't confirmed probably didn't end up on Aurora's leak site. That doesn't mean they got away clean.
Why your AI coding tool is now a security problem
For a while, AI coding tools were treated as productivity software. Install it, write more code, ship faster. Security teams mostly ignored them because the threat model didn't exist yet.
That's changed.
Cursor and tools like it are general-purpose execution environments. They can read files, run commands, make network calls, browse your codebase, and reason about what they find. That's what makes them good at coding. It's also exactly what Aurora's operator needed.
The attack surface this creates is real:
Your developer's machine probably has access to a lot. Cloud credentials in .env files. Database connection strings. SSH keys. Admin tokens. Long-lived sessions. AI coding tools run with the permissions of the user running them, which in most dev environments means they can reach all of that.
Credential theft → AI-assisted lateral movement is now a kill chain. Aurora's playbook isn't sophisticated. Get one credential, open Cursor, ask it what you can see and where you can go. This takes a moderately skilled attacker and makes them dangerous in environments they've never seen before.
AI agents don't know when they're being misused. The attacker wasn't jailbreaking anything or using some obscure exploit in Cursor itself. They were asking reasonable-sounding questions about network configuration and user permissions. The AI answered because answering is what it does.
What to do right now
Audit what your AI coding tools can reach. If a developer is running Cursor with cloud admin credentials loaded in their shell environment, or with database access configured in their IDE, that machine is a much higher-value target than it used to be. Map it out.
Apply least privilege to AI tools the same way you'd apply it anywhere else. Cursor doesn't need to run as an admin. Developers don't need production credentials on their laptops. The AI tool's access ceiling is the user's access ceiling — lower that ceiling.
Segment your network so developer machines can't directly reach production. The Aurora attack worked partly because the operator, once on a developer machine, could reach internal systems from there. If your dev environment and production environment aren't separated, that's worth fixing before it's fixed for you.
Watch for anomalous process behavior. AI coding tools have predictable usage patterns. Cursor making connections to internal hosts at 2am, or generating unusual volumes of outbound traffic, is worth flagging. If you're not logging process-level network activity from developer machines, start.
Treat credentials like credentials. Get them out of .env files on developer machines. Use a secrets manager. Rotate anything that's been long-lived. The Aurora logs show the attacker specifically asking Cursor to enumerate stored credentials and active sessions — that's a step that only works because those credentials were there to find.
The broader point
What's in Gambit's report isn't the last time we'll see this. It's the first confirmed documented case. Other groups are running similar playbooks, and the ones doing it more carefully won't have an exposed open directory revealing their session logs.
The organizations that start thinking about AI coding tools as part of their security posture now — not just their productivity stack — will be in a different position than the ones that wait for their own version of this story.
We do AI security posture reviews for small teams: what your tools can access, where your credentials live, what the realistic attack paths look like against your actual environment. If that conversation would be useful, get in touch.
Update Cursor. Audit your tooling. Don't wait for the logs to surface somewhere.