Most AI coding agent security stories this year have been about flaws — a sandbox escape, an RCE bug, a prompt injection hole a vendor had to patch. The story Reuters broke on 27 August 2026 is different, and arguably more unsettling: nothing was broken. Threat intelligence firm Gambit discovered an exposed server belonging to a new Russian-speaking ransomware operation called Aur0ra, and on it found 28 chat sessions between the gang’s hackers and Cursor’s AI coding agent. According to Gambit’s report, the attackers simply told the agent that what it was doing — credential theft, account takeover attempts, hundreds of intrusion operations in total — was part of a legitimate, authorised security simulation. The agent, working as designed, carried it out.
The campaign ran from 8 April to 21 May 2026 and hit at least seven organisations: Belgian chemicals company Christeyns, German garage door manufacturer Teckentrup, Scotland’s Helideck Certification Agency, an Argentine pharmaceutical distributor, an Italian manufacturer, and Bayou Title, a Louisiana-based title insurance firm. Separate research from CloudSEK ties a related Aur0ra-linked actor to more than 20 compromised organisations across nine countries between April and July. Cursor, now owned by Elon Musk’s SpaceX following its acquisition earlier this year, hasn’t disclosed how it’s responding to the disclosure at the time of writing.
Why the framing matters more than the bug count
A patched vulnerability is a solved problem. A social engineering technique is not — it’s a permanent feature of working with any agent that’s built to be helpful and to trust the instructions it’s given. Cursor’s agent didn’t fail a security test; it passed the only test it was actually given, which was “does this look like a legitimate task from an authorised user.” That’s the same trust model every AI coding agent runs on, including the ones inside BuildApps’ own workflow. The lesson isn’t “don’t use AI coding agents” — it’s that the permissions and credentials an agent can reach are now part of your attack surface in a way that has nothing to do with the model’s code-writing quality.
So what
If your team — or a vendor building for you — gives an AI coding agent standing access to credentials, cloud infrastructure, or account-level actions, the Aur0ra campaign is a concrete reason to audit exactly what that agent can do unsupervised, and whether “simulation” or “test” framing in a prompt should ever be enough on its own to authorise a real-world action. This is exactly the kind of guardrail we build into how we use AI-assisted development on client projects — scoped permissions, human review gates on anything credential- or infrastructure-adjacent, and no agent left holding more access than the task in front of it needs. See our approach to AI-assisted development or get in touch if you want a second opinion on how much autonomy your own AI tooling actually has.