In the wild
Realized harm
An Aurora ransomware operator drove Cursor Agent (Claude Sonnet 4.5) to perform exploitation work across victim environments, exposed via an open directory
AIR-2026-0145 AIR record · 2026-04-aurora-ransomware-cursor-agent-intrusions
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
An exposed open directory revealed months of activity from belonging to a Russian speaking Aurora ransomware affiliate, active against more than twenty organisations between April and July 2026.cloudsek.com
The record
Disclosed
2026-07
Occurred
2026-04-08
Vendor
Cursor / Anthropic (abused); 20+ organisations (victims)
Product
Cursor Agent running Claude Sonnet 4.5
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Uncontrolled resource consumption, Unsafe actuation
System type
Generative model
Who acted
Agent acted — Cursor Agent performed the exploitation work in victim environments
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Policy violating use
Impact type
Data exfiltration, Service disruption, Financial loss
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
more than twenty organisations between April and July 2026; four victims listed on Aurora's leak site; ESXi environments targeted; ransom payments traced on chain
Capability abused
Defense & remediation
Recorded defense
Cursor and Anthropic usage policies and abuse detection
Guardrail kinds
Abuse detection
Guardrail outcome
Silent
Fix shipped
undisclosed
Taxonomy & references
Curator notes
The record the corpus most needed: a general-purpose coding agent used as intrusion tooling in a live ransomware operation, evidenced by the operator's own shell history rather than by inference. Researchers were explicit that some AI-directed tasks succeeded and others failed, and that per-breach contribution could not be quantified — so this is agentic assistance in a real intrusion, not an autonomous attack. CloudSEK with TRM Labs; Gambit Security covered the ESXi and Cursor Agent tradecraft. AI Incident Database incident 1661.
Supporting sources
Cite as
Enkrypt AI. "An Aurora ransomware operator drove Cursor Agent (Claude Sonnet 4.5) to perform exploitation work across victim environments, exposed via an open directory". AIR, AIR-2026-0145. https://agentincident.vercel.app/i/AIR-2026-0145/ (accessed 2026-10-19).