Cursor agent appears in a seven-company attack wave

Cursor Agent appeared in an Aurora ransomware campaign spanning ten target organizations, while Reuters identified at least seven companies that were breached. Gambit Security’s investigation documents the agent’s use between April 8 and May 21, and the Reuters report republished by CNA says the extent of Cursor’s causal contribution remains uncertain. For builders, the fact to file is governance, not attack technique: agentic coding tools need stronger abuse monitoring and refusal recovery than a one-time policy check, a risk that sits beside the case for an agent-security firewall.