Ransomware crew ran Cursor's agent inside ten companies

Cursor's coding agent helped a Russian-speaking ransomware group called Aur0ra break into a Belgian chemical company and at least six other firms, Reuters reported, working from Gambit Security session logs that show an operator running the agent inside ten target organisations between April 8 and May 21.

The method was not an exploit. The operator told the agent the intrusions were authorised security tests, and the agent worked on that basis.

The control was a sentence

A day later, OpenAI told SpaceX it will stop supplying models to Cursor on November 12, the latest date its contract permits after a change of control, saying it cannot be confident SpaceX will keep the technology within its terms of service following the $60 billion all-stock purchase of Anysphere (Reuters).

Read the two stories next to each other and they rhyme. In the first, a claim of authorisation, typed into a chat window by whoever happened to be at the keyboard, was the whole of the control. In the second, the control OpenAI is invoking against a buyer it cannot audit is a contract clause and a statement of confidence about future conduct. Neither is enforcement. Both are a promise about intent, evaluated by the party being asked to trust it.

The ledger's record on Anysphere sharpens the second one. OpenAI's own startup fund led the company's $8M seed round in October 2023 (Wikipedia), and Cursor now runs at roughly $2.6B of annualized revenue (Yahoo Finance). The supplier relationship survived the seed cheque, the years between, and the growth into a serious revenue line. It did not survive a change in who owns the customer, because ownership is the one thing a terms-of-service clause cannot follow.

What enforcement would look like

The same day, Harness launched Harness Code Repository, a source control product built to absorb thousands of pull requests and commits opened at once and to hold AI agents inside access controls set by the customer (The Stack).

Take the framing rather than the product. Access controls set by the customer are not a claim the agent can be talked out of. Aur0ra did not need to defeat one, because the agent it was driving asked for a reason and accepted the one it was given.

The measurement is pointed somewhere else

SentinelOne and Tenable found in joint research that exposure data and runtime detection converge on the same edge-device vendor surfaces 79% of the time but overlap only 21% at the individual vulnerability level, while the median organisation still takes five months to remediate known vulnerabilities (SMEStreet).

That is a real gap, and it is not the gap the Cursor intrusions went through. No edge device was involved and no vulnerability was exploited. An agent holding legitimate access, handed a false premise in plain language, leaves a scanner nothing to flag and never starts the five-month clock. The organisations in those session logs were compromised for six weeks by something their remediation programme was not built to see, and the one artefact that recorded it was a transcript.

The lesson the week offers is narrow and unglamorous: for an agent with real credentials, the question is not whether it was told it had permission. It is whether anything checked.