LLMHigh
Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations
- Occurred
- Apr 8, 2026
- Published
- Aug 27, 2026
- Source
- AI Incident Database
Summary
Between April 8 and May 21, 2026, a Russian-speaking operator linked to the Aurora ransomware group reportedly used Cursor Agent, running Anthropic's Claude Sonnet 4.5, to assist exploitation across multiple organizations. Researchers said some AI-directed tasks succeeded while others failed; independent reporting identified six affected companies but could not determine how much the AI facilitated each breach or whether all led to data theft or extortion.
Developers
- Anysphere
- Anthropic
- AI agent system developers
- Large language model developers
Deployers
- Aurora ransomware affiliate
- Cybercriminals
- Ransomware operators
- Agentic threat actors
- AI agent system deployers
Harmed parties
- Christeyns
- Teckentrup
- Helideck Certification Agency
- Bayou Title
- Companies
- Organizations
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: AI model used to facilitate cyberattacks causing data breaches and extortion against multiple organizations.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8