Aurora ransomware actors have been observed abusing SpaceX’s AI Cursor Agent as part of exploitation campaigns, according to a new study by Gambit Security’s Threat Intelligence team. The threat actors ran Claude Sonnet through Cursor Agent to assist with various exploitation activities against 10 victims between April 8 and May 26, 2026. These tasks included scanning the victim’s environment for reconnaissance purposes, installing a VPN client and running certificate attacks. While Cursor Agent did not always achieve its stated objectives, the research demonstrated how threat actors are continuously experimenting with AI tools to speed up and enhance their campaigns. Cursor Agent is used by software developers to complete complex coding tasks independently, run terminal commands and edit…