Skip to Content
logologo
AI Incident Database
Donate
Discover
Submit
  • Welcome to the AIID
  • Table View
  • List view
  • Entities
  • Taxonomies
  • Spatial View
  • Blog
  • AI News Digest
  • Random Incident
  • Sign Up
Discover
Submit
  • Welcome to the AIID
  • Table View
  • List view
  • Entities
  • Taxonomies
  • Spatial View
  • Blog
  • AI News Digest
  • Random Incident
  • Sign Up

Incident 1661: Aurora Ransomware Operator Reportedly Used Cursor Agent to Assist Intrusions Against Multiple Organizations

Description: Between April 8 and May 21, 2026, a Russian-speaking operator linked to the Aurora ransomware group reportedly used Cursor Agent, running Anthropic's Claude Sonnet 4.5, to assist exploitation across multiple organizations. Researchers said some AI-directed tasks succeeded while others failed; independent reporting identified six affected companies but could not determine how much the AI facilitated each breach or whether all led to data theft or extortion.

Tools

New ReportNew ResponseDiscoverView History

Entities

View all entities
Alleged: Anysphere , Anthropic , AI agent system developers and Large language model developers developed an AI system deployed by Aurora ransomware affiliate , Cybercriminals , Ransomware operators , Agentic threat actors and AI agent system deployers, which harmed Christeyns , Teckentrup , Helideck Certification Agency , Bayou Title , Companies and Organizations.
Alleged implicated AI systems: Cursor , Claude Sonnet 4.5 , Claude , AI agent systems , Claude AI models , Large language models , LLM-integrated code assistant , Aurora ransomware and Ransomware

Incident Stats

Incident ID
1661
Report Count
3
Incident Date
2026-04-08
Editors
Daniel Atherton

Incident Reports

Reports Timeline

Incident Occurrence+2
Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies
Loading...
Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies

Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies

reuters.com

Loading...
Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation

Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation

gambit.security

Loading...
Caught in 4K: The Aurora Files

Caught in 4K: The Aurora Files

cloudsek.com

Loading...
Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies
reuters.com · 2026

Russian-speaking hackers used SpaceX's (SPCX.O), opens new tab AI coding assistant, Cursor, to help break in to a Belgian chemical company and at least six other firms earlier this year, according to data reviewed by Reuters and reports iss…

Loading...
Aurora ransomware targets ESXi, abuses Cursor Agent for exploitation
gambit.security · 2026

Gambit Security's Threat Intelligence team investigates emerging attacker tradecraft and the evolving ways threat actors disrupt organizations. As part of this research, we track threat actors and their operations to identify new techniques…

Loading...
Caught in 4K: The Aurora Files
cloudsek.com · 2026

Executive Summary

An exposed open directory revealed months of activity from belonging to a Russian speaking Aurora ransomware affiliate, active against more than twenty organisations between April and July 2026. The directory included the …

Variants

A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?

Similar Incidents

By textual similarity

Did our AI mess up? Flag the unrelated incidents

Loading...
Fraudsters Used AI to Mimic Voice of a UK-Based Firm's CEO's Boss

Fraudsters Used AI to Mimic Voice of a UK-Based Firm's CEO's Boss

Mar 2019 · 1 report
Loading...
AI-Generated Profiles Used in Disinformation Campaign Targeting Ukrainians

AI-Generated Profiles Used in Disinformation Campaign Targeting Ukrainians

Feb 2022 · 6 reports
Loading...
Chinese Chatbots Question Communist Party

Chinese Chatbots Question Communist Party

Aug 2017 · 16 reports
Previous IncidentNext Incident

Similar Incidents

By textual similarity

Did our AI mess up? Flag the unrelated incidents

Loading...
Fraudsters Used AI to Mimic Voice of a UK-Based Firm's CEO's Boss

Fraudsters Used AI to Mimic Voice of a UK-Based Firm's CEO's Boss

Mar 2019 · 1 report
Loading...
AI-Generated Profiles Used in Disinformation Campaign Targeting Ukrainians

AI-Generated Profiles Used in Disinformation Campaign Targeting Ukrainians

Feb 2022 · 6 reports
Loading...
Chinese Chatbots Question Communist Party

Chinese Chatbots Question Communist Party

Aug 2017 · 16 reports

Research

  • Defining an “AI Incident”
  • Defining an “AI Incident Response”
  • Database Roadmap
  • Related Work
  • Download Complete Database

Project and Community

  • About
  • Contact and Follow
  • Apps and Summaries
  • Editor’s Guide

Incidents

  • All Incidents in List Form
  • Flagged Incidents
  • Submission Queue
  • Classifications View
  • Taxonomies

2026 - AI Incident Database

  • Terms of use
  • Privacy Policy
  • dd3f754