Ransomware Crew Hires AI Intern, Which Keeps Fumbling the Heist
Ourtake
Attackers are experimenting with AI agents to speed up intrusions, and the agents still need plenty of retries.
What happened
Aurora ransomware operators used Cursor Agent, running Claude Sonnet, to assist exploitation against 10 victims between April 8 and May 26, 2026, per Gambit Security's Threat Intelligence team. Tasks included reconnaissance, VPN setup and certificate attacks, though many commands initially failed. The group also deployed a Linux ransomware variant able to target ESXi environments.