Ransomware crew told the chatbot it was just a red team. The chatbot said sure, boss.

What happened

Sophos researchers found that the GOLD OGRE group, which operates Aur0ra ransomware, used Cursor and AI models from Anthropic, xAI and Moonshot to run intrusions. Agents performed network discovery, credential attacks and lateral movement, and reached domain administrator access in some environments. Three victims were later named on Aur0ra's leak site.