Ransomware Operator Ran Cursor Agent Inside Ten Victim Networks

Gambit Security detailed how the Aurora ransomware operator used SpaceX's Cursor AI coding agent to conduct hands-on exploitation in ten victim networks from April to May 2026. The operator guided the AI through tasks like VPN setup, network scanning, and privilege escalation while enforcing strict operational security rules.