Apr 8, 2026Confirmed
Ransomware operator reportedly used Cursor Agent with Claude Sonnet 4.5 to help breach several organizations
AI loose in the worldOtherDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Between April 8 and May 21, 2026, a Russian-speaking operator linked to the Aurora ransomware group reportedly used Cursor Agent, running Anthropic's Claude Sonnet 4.5, to assist intrusions. Some AI-directed tasks failed. Reporting identified six affected companies but could not say how much the AI helped each breach.
What this means for youCriminals are using AI coding agents to help break into company systems, though how much the AI helped is unclear. Small businesses should keep systems patched and make sure backups are stored offline.
Sources
- AI Incident Databasehttps://incidentdatabase.ai/cite/1661
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Source data license: CC BY-SA 4.0 (database). Report contents keep their own rights; reports.text, submissions, images and videos are excluded from the data license.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2293. It has not been edited since it was approved; the hash above would not match if it had. How to verify