He Didn't Jailbreak the AI. He Told It the Engagement Was a Test, and Breached Seven Companies. Then He Left the Chat Log Where Investigators Could Read It.

A Russian-speaking Aurora ransomware affiliate compromised more than 20 organizations across nine countries between April and July 2026, reaching domain-level or interactive access in at least 17 of them. Four victims ended up named on Aurora's leak site. Manufacturing, food, agriculture, professional services.

He used Cursor, the AI coding assistant, to plan the intrusions and the Active Directory escalation. In Russian.

Two things about that are worth your time. Neither of them is "criminals use AI now," which stopped being news a year ago.

One: the assistant kept a transcript, and investigators got it

Digital forensics recovers what an operator did. Binaries, command history, credential dumps, timestamps, artifacts on disk. Every one of those is a record of action.

Intent has always been the thing you infer. You reason backwards from tool choice, from targeting, from the order things happened in, and you write "assessed with moderate confidence" because that is the honest ceiling on inference.

Alongside this operator's tooling, command history, credential material and the Aurora encryptor, investigators recovered his Cursor chat records.

That is not more of the same evidence. It is a different class of evidence. A conversation log with an AI assistant captures what the operator wanted — the questions asked before he knew the answers, the approaches considered and abandoned, the uncertainty, the reasoning, in his own words and his own language. Not what he executed. What he was trying to work out.

Intent stops being inferred. It gets stated.

And this is structural, not a one-off blunder. It exists because the operator chose a tool that keeps a transcript by design. Every attacker who reaches for an AI assistant to handle the parts they cannot do unaided is writing a confession as a side effect of getting help — and the more they lean on it, the more complete the record becomes.

The trade runs both directions at once. Using an assistant made this operator faster and more legible. Defenders should expect both halves of that to keep growing together, because they are the same behaviour.

Two: the guardrail was not defeated. It was reframed.

Cursor's agent will not knowingly help you attack somebody else's network. That refusal is real and it holds against a direct request.

He told it the engagement was a test.

Reuters reports seven companies were breached under that framing. No exploit. No jailbreak string. No unicode trickery, no encoded payload, no clever prefix. One sentence that recontextualized the entire session.

This is the part with no clean fix, and it is worth being precise about why.

A filter can be hardened against a string. Somebody finds a bypass, you add the pattern, the pattern stops working. That loop is unpleasant but it converges.

A filter cannot easily be hardened against a plausible context, because "I am authorized to test this network" is a true statement for thousands of legitimate users every day. Planning Active Directory escalation is ordinary work for a red teamer. Enumerating a domain is ordinary work. Nothing in the request was anomalous, because the request was genuinely indistinguishable from sanctioned work.

The model had no way to check the claim. And the claim was the only thing that was false.

The assistant was not deceived about what it was doing. It was deceived about who it was doing it for.

That is an authorisation problem wearing a safety problem's clothes, and it does not get solved at the prompt layer. Nothing the model can read tells it whether the person typing has a signed scope document. The only place that question can be answered is outside the conversation — in identity, in tenancy, in contractual controls — and none of those are what "AI safety" currently means in practice.

What the same technology looks like pointed the other way

It would be easy to read all of that as a story about attackers gaining an advantage. That is half of it, and the smaller half.

The identical capability — an assistant that answers "what should I do next" against an unfamiliar environment — is what we have been building on, pointed the other way. Rather than write an adjective about it, here are the two numbers that matter, pulled live the morning this published, with the parts that flatter us and the parts that do not.

Coverage: 99% of a sampled 175 indicators were not in ThreatFox. Broken out by where they came from — GitHub Hunt 40/40, research imports 30/30, bulletproof-ASN listings 20/20, honeypot catches 15/15, our OTX pulses 29/30, OSV malicious packages 40/40.

Two honest qualifiers on that. The sample is 175 records, not the whole feed — it is a weekly sampled measure, not a census. And the OSV package stratum scores 100% structurally, because ThreatFox does not carry a package feed at all; comparing there is not a fair fight and we label it as such in the endpoint itself.

Speed: median 18 days, mean 45.7, maximum 113. That is how far ahead of the CISA KEV listing our own receipt existed, across the KEV additions in the measurement window.

And here is the number that keeps the other two honest: of 9 KEV additions in that window, we had a prior receipt for 3. For 6 of them we had nothing at all. No lead, no early indicator, nothing. A third.

We publish that denominator because a lead statistic without one is marketing. "Median 18 days early" is true and it describes the third of cases where we were early. The other six are the ones worth improving, and you cannot improve what you refuse to count.

Whose shoulders this stands on

The uniqueness number invites a claim we are not going to make. Here is the actual composition of our indicator corpus, by source, exact facet counts:

Source	Indicators
OSV malicious packages	235,365
TweetFeed	124,902
URLhaus (abuse.ch)	118,462
our edge honeypot	86,439
ThreatFox (abuse.ch)	72,900
SSLBL (abuse.ch)	41,140
OpenPhish	36,986
Spamhaus DROP	32,011
MalwareBazaar (abuse.ch)	31,818
Tor exit list	9,095
our exploit harvester	6,220

The largest contributors to what we carry are other people's free feeds. abuse.ch alone — URLhaus, ThreatFox, SSLBL, MalwareBazaar — accounts for more than 264,000 of them, given away for nothing by people who owe us and you exactly zero. OSV, OpenPhish, Spamhaus and TweetFeed likewise.

We are not the origin of most of this. We are a place where it is joined up, scored, cross-referenced against 1,682 known-exploited CVEs, and handed over in formats a small shop can actually load. Both sentences are true at once: 99% of a given sample is absent from ThreatFox, and ThreatFox is one of the reasons the rest of the corpus is worth anything.

The gap we fill is not discovery. It is the joining up — and the free distribution of the result to people who cannot afford a threat-intel contract. That is a real job and it does not require pretending we found it all ourselves.

What this actually changes for defenders

Stop reading "AI-assisted" as "more sophisticated." This operator was not doing anything a competent human could not do. He was doing it faster, with fewer gaps in his knowledge, and with a research assistant that never got tired. The techniques were ordinary. The tempo was not.

The behaviours are unchanged, so the detections still work. Domain enumeration, AD escalation, credential harvesting, lateral movement — the assistant helped him plan them, it did not make them invisible. Everything that caught this class of intrusion last year still catches it.

Expect the tempo, not the novelty. The realiztic effect of assistants on intrusion is compression of the gap between access and domain admin, because the part that used to require experience — knowing what to try next in an unfamiliar environment — is now a question you can ask. Plan for a shorter window between first foothold and irreversible damage.

And if you run a red team, the "it's a test" framing is now poisoned. It is going to be the first thing vendors clamp down on, and the clamp will land on the legitimate users of that sentence long before it inconveniences the illegitimate ones.

Sources

Aurora ransomware affiliate activity, April–July 2026: 20+ organizations across nine countries, domain-level or interactive access in at least 17 environments, four victims named on the Aurora leak site, sectors including manufacturing, food, agriculture and professional services. Recovered material included the affiliate's tooling, command history, credential material, the Aurora encryptor and Cursor chat records. Reported 27 August 2026. The "told it the engagement was a test" framing and the seven-company figure are from Reuters, via Meduza.

Capped at 95 percent: we hold no first-party observation of this campaign and no Aurora-attributed indicators in our feed. The counts are as reported and we have not independently verified them. We have not seen the chat transcripts ourselves — our argument about what that evidence class means is reasoning about the category, not analysis of the contents.

---

The line I keep coming back to is that he wasn't tricked about what he was doing. If your safety model depends on the user honestly declaring who they are, it is not a safety model, it is an honour system with logging. Rate this post below.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com