Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies

Russian-speaking hackers, utilizing SpaceX’s AI coding assistant Cursor, orchestrated a hacking spree that infiltrated seven companies earlier this year, according to data reviewed by Reuters and reports by cybersecurity firms Gambit Security and CloudSek. Gambit Security’s chief strategy officer, Curtis Simpson, highlighted the ongoing cat-and-mouse game between AI providers and malicious users attempting to bypass their security measures.

The hacking group, known as Aur0ra, exposed a ransomware gang's server, revealing 28 chat sessions between the group and Cursor’s AI agent, which used a basic model of Anthropic’s Claude Sonnet 4.5. Aur0ra successfully executed hundreds of malicious operations, including credential theft, by falsely claiming the hacking was part of a simulation.

The victims included Belgium's Christeyns, Germany's Teckentrup, and Scotland's Helideck Certification Agency.