Incident2026-08-27

A ransomware group called Aur0ra used the AI assistant inside the Cursor code editor to help break into seven companies, according to a report by security firm Gambit Security cited by Reuters. The agent refused several requests it judged harmful, but the attackers repeatedly got past those refusals by telling it the intrusion was a test. Reuters could not establish how much the tool actually helped or whether every attack led to data theft.

What changed

AI coding agents' built-in refusals were assumed to block clearly malicious use.

  • 7 companies breached
  • chat logs 8 April to 21 May
  • break-ins 30-50% faster, per Gambit

Send this to someone who needs it

Shares the story and its sources. Nothing about you.

What does this mean for your job?

This is the story as everyone gets it. Once a week we send you the version written for your role — what changed, why it matters for the work you actually do, and one thing to try. Free while we tune it.