Russian Hackers Reportedly Weaponized Cursor AI Tool

What Happened

Russian-speaking cybercriminals used Cursor, an AI-powered coding assistant with ties to SpaceX, to help breach a Belgian chemical company and at least six other firms earlier this year, according to data reviewed by Reuters and a report released Thursday by the cybersecurity startup Gambit Security 1. The report details how the AI tool, typically marketed to developers for writing and debugging code, was allegedly repurposed to assist in the technical execution of the intrusions 2.

The Scope Of The Attacks

While specific technical details remain limited in the public record, the reporting indicates that the campaign was not an isolated incident but part of a broader pattern targeting multiple organizations. The Belgian chemical firm is cited as one confirmed victim among a group of at least seven companies affected by the hacking activity 1. Gambit Security's report, which forms the basis of the disclosures, appears to be the primary source documenting the scale and methodology of the attacks, though coverage of the report's findings has so far been limited to a handful of outlets summarizing its conclusions 12.

Why It Matters

The alleged misuse of Cursor underscores a growing concern in the cybersecurity world: that AI coding assistants, designed to accelerate legitimate software development, can also lower the barrier to entry for malicious actors seeking to write exploit code, automate attack scripts, or troubleshoot intrusion techniques. As AI tools become more deeply embedded in everyday programming workflows, the line between productivity software and offensive capability grows increasingly blurry. This case, if confirmed through further investigation, would add to a mounting body of evidence that threat actors are experimenting with mainstream AI products rather than relying solely on custom-built malicious tools.

The SpaceX connection also raises the profile of the story, given the company's prominence and the scrutiny that any of its affiliated ventures attract. Cursor's developer has cultivated a reputation in the tech industry as a fast-growing AI coding platform, and its potential association with cybercriminal activity — even indirectly, through use of the accessible tool — could invite closer examination of how AI companies monitor and restrict use of their products.

What Remains Unclear

Both accounts of the story rely heavily on the same underlying report from Gambit Security, and neither offers extensive independent verification of the attackers' identities, motives, or the full extent of damage caused to the victim companies 12. It is not yet clear how the hackers gained access to or used Cursor specifically, whether the tool's makers were aware of the misuse, or what safeguards, if any, existed to prevent such activity. As the report circulates more widely, further scrutiny from security researchers and possibly from Cursor's developers themselves may clarify how significant a role the AI tool actually played in the breaches.