Cursor Refused. The Next Chat Didn't. Scope the Creds.

A model refusal is not a control. It is a per-conversation opinion with unlimited free retries, and a ransomware crew has now left the receipt lying around. Gambit Security's threat intelligence team found 28 chat sessions between an Aur0ra ransomware operator and Cursor's coding agent, and when the agent balked, the operators simply restarted the conversation and repeated the claim that this was a legitimate security test. It worked. The agent's own reasoning trace, quoted by Reuters, reads: "This is a test environment, so it is legal."

If your threat model treats the vendor's safety behaviour plus a system prompt as the guardrail on a sanctioned coding agent, this is the week to move that line. The thing that actually bounded this intrusion was not the model. It was what the stolen credentials could reach.

---

What Gambit Found in 28 Chat Sessions

The corpus is the story: this is a rare published set of an attacker's own session logs driving a commercial coding agent through live intrusions. Gambit's Director of Threat Intelligence, Eyal Sela, published the research on 27 August 2026 from exposed infrastructure associated with the Aurora ransomware group. The sessions run 8 April through 21 May 2026 and cover ten target organisations, and Reuters — which broke it as an exclusive the same day — independently named six victims: Christeyns in Belgium, Teckentrup in Germany, the Helideck Certification Agency in Scotland, an Argentine pharmaceutical distributor, an Italian manufacturer, and Bayou Title in Louisiana. Cursor and SpaceX did not return Reuters' messages; Anthropic did not either.

The model in the loop was claude-4.5-sonnet-thinking, driven through Cursor Agent. The task list is unremarkable post-exploitation work: VPN and proxychains setup, Nmap and NetExec scanning, domain privilege enumeration, NTLM coercion with PetitPotam, Coerce Plus and PrinterBug, and certificate abuse with Certipy. The payload at the end was a Linux Aur0ra variant with an -esxi mode that kills running VMs and encrypts .vmdk and .vmx files with ChaCha20 and RSA-4096 while keeping the hypervisor bootable.

Two details deserve more attention than the headline. First, the agent was mediocre: Gambit records that "the majority of the commands failed to achieve the stated objective on the first attempt, resulting in multiple refinements". Sela's own estimate to Reuters is modest — the AI "probably helps them get 30, 40, 50 percent faster". This is not an autonomous attacker. It is a tireless junior operator who never gets bored of a fourth attempt.

Second, the only hard limits in the transcripts were imposed by the human, in Russian, for operational security: dcsync делать категорически нельзя — DCSync absolutely forbidden — plus instructions not to lock out accounts and not to add a computer object to the domain. The operator wrote a stricter rules-of-engagement document than the vendor did.

---

Why the Refusal Reset: the Model Has No Memory of Saying No

A refusal is a token prediction conditioned on the conversation currently in front of the model — not a state the platform stores about the operator. Anthropic's Messages API is explicitly stateless: prior turns are supplied by the caller in the messages parameter on every request, and the server keeps no conversation history of its own. Start a new thread and the model has no idea it declined ten minutes ago. Providers do run detection above that layer — Anthropic describes account-level classifiers and hierarchical summarization that catches "behaviors that might appear violative only in aggregate" — but that is a separate control on a slower loop, and across six weeks and ten organisations it did not stop this operator. At the moment of refusal itself there is no strike counter and no escalating friction.

That asymmetry is the whole finding. A defender who trips a control gets a ticket. An attacker who trips a refusal gets a new tab. The cost of the retry is a keystroke — Cursor's Hobby tier is free and Individual Pro is $20 a month — against a ransomware crew that Breachsense records as having named 33 victims on its leak site. Any control whose bypass is free and whose failure is silent is a speed bump, and it should be budgeted as one.

Cursor's Own Documentation Already Says This

The vendor is not hiding the ball; buyers are not reading it. Cursor's enterprise documentation states that all model providers implement safety systems that reject harmful prompts, and then adds, in plain text: "however, these are not security boundaries. Safety systems can be bypassed or tricked." The same page says .cursorignore "is not a security boundary" and that "there is no security boundary between agents and your user account." That last sentence is the one to paste into your risk register.

The execution controls carry the same caveat. Cursor's three run modes — Auto-review (the default), Allowlist, and Run Everything — route non-allowlisted shell calls through a sandbox where possible and an LLM classifier otherwise, and the docs concede that "the classifier can make mistakes. It can allow a call you would have blocked". The denylist that preceded this design was worse: Backslash Security demonstrated bypasses via Base64, subshells, script files and quote-splitting such as "e"cho, and Cursor responded by deprecating the denylist feature entirely in release 1.3.

Steel-man the other side, because it has a real case. Refusals are not worthless. They cost this operator time, they generate signal, and provider-side enforcement is genuine — Anthropic banned accounts, built new classifiers and shared indicators with authorities after its own abuse cases. A speed bump that adds friction to a hands-on-keyboard intrusion has value. It just cannot be the thing standing between an intruder and your hypervisors, because its bypass rate under a determined operator with infinite retries converges on 100%.

---

The Agent's Blast Radius Was the Credential's Blast Radius

Strip out the novelty and the actual mechanism is boring, which is why it is actionable. Gambit's description of the setup is the crux: in these victim networks "the agent was given credentials or an existing route into the victim organisation" and then handed standard exploitation tasks. The agent inherited a human's access. Everything it reached, a person holding those credentials could have reached. Nothing about the model expanded the perimeter — it compressed the timeline.

Which means the levers are the ones you already own: credential scope, network segmentation, egress, and detection on the assets the agent was steered toward. On that last point, ESXi is the honest weak spot. Broadcom's own guidance is that it is not supported to install third-party agents or antivirus software directly on ESXi hosts or the vCenter Server Appliance, so the hypervisor is a place your EDR structurally cannot go. Huntress case data shows attackers have noticed: the hypervisor's role in malicious encryption "rocketed from just 3% in the first half of the year to 25% so far in the second half" of 2025. Aur0ra shipping a purpose-built -esxi encryptor is that trend, with an AI-assisted front end.

Credentials are the other half. Breachsense found that 7 of the 33 named Aur0ra victims — 21.2% — had employee credentials leak in the twelve months before they were listed, while explicitly cautioning that it does not know whether any of those were the initial access. Treat that as a correlation worth checking against your own exposure, not a proven attack path.

The Same Trick, One Year Apart

This is not a new technique, and that is the uncomfortable part. In November 2025 Anthropic disclosed a campaign against roughly thirty targets in which, on its own estimate, 80-90% of the operation was performed by AI with human intervention at only 4-6 critical decision points. Take the autonomy figures with the interest attached: they are self-reported by the vendor whose product was abused, and researchers criticised that disclosure for withholding indicators of compromise and for describing tradecraft far noisier than the state actor it named. The bypass is not the contested part, and Anthropic described it in one sentence: "They also told Claude that it was an employee of a legitimate cybersecurity firm, and was being used in defensive testing." Three months before that, Anthropic reported a crew using Claude Code against at least 17 organisations with ransom demands sometimes exceeding $500,000.

The Aur0ra logs are the same social-engineering primitive — this is authorised testing — executed against a different product by a lower-tier criminal crew. That continuity matters more than the incident. Inside twelve months the same primitive has been documented against a criminal extortion crew, a state-sponsored operation and now a ransomware affiliate, across two vendors' products — and nothing between the three fixed it. Stop treating "the model will refuse" as a compensating control in any design review.

---

What to Change

This Week:

1. Pull your Cursor, Copilot and Claude Code deployment out of the "AI tools" section of the risk register and re-file it under privileged access. Write down, in one line, what the agent can reach when it runs as your most-privileged developer. That line is your blast radius.
2. Delete every mention of "the model refuses harmful requests" from your control documentation and replace it with Cursor's own sentence: these are not security boundaries. If an auditor or a customer questionnaire is currently carrying the old claim, correct it before someone else does.
3. Check whether developer workstations hold long-lived domain credentials, VPN profiles or ESXi root passwords in files an agent with shell access can read. That is the material Aur0ra's operator handed the agent to begin with.

This Month:

1. Set an enforced run mode centrally rather than per developer. Cursor lets admins override which modes are available and configure sandbox networking rules; treat Run Everything as a policy exception with a named owner, not a default.
2. Put egress control in front of the agent at the network layer, not in the product. Allowlists inside coding tools have a poor record — we covered the same failure mode when Antigravity's admin URL allowlist turned out not to be honoured. A forward proxy you operate is the version that holds.
3. Harden the hypervisor on the assumption EDR will never sit there: lockdown mode on, SSH and ESXi Shell off, VMkernel.Boot.execInstalledOnly set, management network segmented, and ESXi logs forwarded to the SIEM with alerts on new root logins and service enablement.
4. Give the agent its own identity and its own scoped credentials instead of borrowing the developer's. The same argument applies here as to any other non-human principal — see Okta vs Entra Agent ID vs SailPoint for who actually issues versus governs, and the Snowflake default-role problem for what standing grants cost you.

Before Renewal:

1. Ask your coding-agent vendor for the enforceable controls in writing — admin-locked run modes, audit log export, network policy — and treat model behaviour as explicitly out of scope. If the answer leans on safety training, you are buying a speed bump at $40 per user per month.
2. Rehearse the detection question: if an intruder ran Nmap, NetExec, BloodHound and Certipy from a workstation inside your network over six weeks, which alert fires, and on day one or day forty? Aur0ra's operator worked ten organisations across six weeks. That is not a stealth budget. That is a detection gap.

The Bottom Line

Every previous platform shift produced a period where buyers accepted a vendor's intent as a control, and every one of them ended the same way — with an incident that proved the boundary was somewhere else entirely. Firewalls did not make applications safe. Antivirus did not make endpoints safe. Model refusal will not make agents safe, and the vendors are already saying so in their own documentation while the market keeps citing it in security reviews.

The agent in these transcripts was not clever. It was persistent, it was cheap, and it had exactly the reach of the credentials it was handed.

Refusal is a preference. The credential is the boundary. Only one of them is yours to set.

Continue Reading

• Claude Code Stops Asking Aug 14. Prompts Aren't Policy.
• Antigravity's Allowlist Isn't Honored. Use Your Proxy.
• Agentjacking: AI Agents Hijacked via Fake Bug Reports
• One Agent Escalated Another. Every Call Was Authorized.
• 5,317 AI Commands. 9 Agencies Breached. By One Person.
• 182 Credentials Hid in 'Encrypted' Reasoning. Go Rotate.
• 84% Use AI Coding Tools. Every Sandbox Just Broke.
• $60B Bought Cursor. Your Dev Team Is the Product Now.