Aur0ra used a Cursor agent to break into seven companies: intent-based guardrails failed

In reporting that landed on August 27, Gambit Security and Reuters documented 28 chat sessions in which an affiliate of the Aur0ra ransomware group used a Cursor coding agent, running on Claude 4.5 Sonnet, to carry out credential theft, network mapping and account takeover at at least seven companies, among them Christeyns, Teckentrup and Helideck. The operator got the agent to cooperate by telling it the work was a security simulation. Gambit estimates the agent made the operator 30-50% faster. It is the first publicly documented case of a coding agent accelerating a real intrusion, and it is not a jailbreak story. It is a story about what the agent was allowed to run.

What the sessions show

The tradecraft was commodity. NetExec for credential spraying and lateral movement, BloodHound for mapping Active Directory paths, NTLM relay, certificate abuse. None of it requires a frontier model; all of it is in a hundred pentest writeups the model has read. What the agent added was speed: it wrote the commands, parsed the output and proposed the next step, as it does when fixing a build. The operator's contribution was a sentence claiming the target was authorized.

That sentence is the failure. The guardrails deciding whether to proceed were reasoning about declared intent: is this a pentest, does the user say they are authorized. Declared intent is free to fake. Every one of those 28 sessions passed the intent check, because the intent check is a question the attacker answers.

A guardrail that asks the user whether they are allowed to do something is a guardrail the attacker configures.

Why behavior beats intent

The actions themselves were not ambiguous. An agent running NetExec against a subnet it was not started in and relaying NTLM authentication is doing intrusion work regardless of what the chat says. A control that looks at what the agent executes, connects to and reads catches that without having to believe anyone. That is the shift: from what the user claims to what the process does.

It is also why the vendor is the wrong place to expect the fix. A different model with the same tool access would have done the same work, because the work is shell commands. The control point is the harness, which is the argument in sandboxing coding agents for a different threat, and it holds for this one.

A policy for agents that can run things

If your team uses Cursor, Claude Code, Codex or anything that executes commands, write down answers to these before an incident writes them for you.

• What the agent may execute. An allowlist of binaries and an explicit denylist for offensive tooling (NetExec, BloodHound, credential dumpers, relay frameworks) on any machine that is not a dedicated, isolated pentest host.
• What the agent may connect to. Egress control per agent process: no lateral connections to internal subnets it was not started against, no outbound to arbitrary hosts. The approval modes in Codex are one existing model of this; the point is that network access is a permission, not a default.
• What the agent may read. Credential stores, browser profiles, SSH keys and password managers are off limits unless a human grants access for one session.
• Every agent action is a privileged operation. Log commands, network calls and file reads with the agent identity attached, and route them where your admin-action logs go. If you cannot say what the agent ran last Tuesday, you cannot investigate this when it is yours.
• No simulation bypass. "This is a test" and "we are authorized" are not inputs the policy engine reads. Authorization for offensive work is a configuration set by a human on a specific host, not a phrase in a prompt.

The honest gap

The count of seven companies and the 30-50% speed estimate are Gambit's, reported through Reuters, and Gambit is a security vendor with an interest in the story being large. I have not seen the 28 transcripts, only the reporting on them, and I do not know how many attempted actions the agent refused before the simulation framing succeeded. What I am sure of is the structural point, because it does not depend on the numbers: intent-based guardrails failed at least once in the wild, and behavior-based controls on the harness are the only layer you fully own.