Build1 publisher2 min readPublished
Aurora put a Cursor agent on the keyboard for its ESXi exploit work
GBHackers reports Aurora operators handing vulnerability analysis and payload delivery to Cursor agents against ESXi hypervisors, and Anthropic's September 2026 assessment describes the same delegation running for months inside state-linked campaigns.
The Engineer · Build desk
What happened
- A ransomware crew called Aurora used Cursor to write exploit code for ESXi hypervisors this month and hit production infrastructure with the machine-generated payloads, according to a dev.to write-up dated to September 2026.
- The GBHackers weekly intelligence report describes human operators picking the target and setting the objective, with the agent doing vulnerability analysis, exploit development and payload delivery.
- Anthropic's September 2026 threat assessment sorts AI misuse into seven categories and puts autonomous cyber operations at the top of them.
- China-based actors used AI-assisted analysis to identify more than a dozen potential zero-day vulnerabilities in a single month, according to that assessment.
- French actors breached 14 of 42 targets, one in three, and built a dark-web doxxing engine holding tens of millions of records.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint An incident process funded on the assumption of a live intrusion does different work when the kill chain finishes inside the same window as your mean time to detect; the post's claim is that you end up triaging completed compromises.
- cost Bug hunting at population scale is priced in instance-hours now, and the post estimates that sweep cost less than one senior security researcher's monthly salary, so the line item moves from headcount to cloud spend.
- exposure Any stack that blocks a payload and returns a verdict is handing an agent a pass/fail test result, and Anthropic reports that loop recompiling malware across 24 Ukrainian institutions for 130 days.
- decision Threat models written around AI assisting a human operator now need a case where the objective itself is handed off, which the post dates to the past year.
A coding agent is productive because something answers back. Write code, run it, read the error, change one line, run it again. According to the dev.to write-up, that is what happened here: an agent with tool access wrote functional exploit code, tested it, and iterated on failure [3]. The loop needs an oracle, and exploitation has an unusually clean one. A payload lands or it faults, and the fault text usually names the build it faulted on. The post argues the agent does not need to be creative, only persistent and fast [4].
Iteration in someone else's environment is noisy by construction. An agent that fixes its way to a working hypervisor exploit fails on that hypervisor first, several times, before it succeeds. Where the loop should degrade is on targets that return nothing useful on failure, and on one-shot access where a bad attempt burns the foothold.
The 10-hour figure in the same post deserves what any benchmark gets. Frontier AI agents went from initial access to data exfiltration in under 10 hours [5], against a human red team timeline the post measures in days [6]. For those 10 hours to say anything about your own exposure, the test environment would have to resemble yours on the things that actually gate lateral movement: patch level, network segmentation, credential reuse, and whether endpoint tooling was blocking or only logging. The post does not identify who ran that test, the network it ran against, or the model and approval settings Aurora's agent used [16].
Anthropic's assessment describes adversaries "increasingly delegating multiple stages of attacks to AI systems" where human involvement narrows to target selection and reviewing results [8].
The scale case in that report is the one I would put in front of a budget holder. One operator processed 1.8 million Android APKs using 10 AWS workers, hunting for exploitable weaknesses [11]. That is 180,000 binaries per worker [1].
What to watch
- Whether GBHackers or Anthropic publish session-level detail: the model, the tool permissions and the approval settings Aurora's agent ran with.
- Whether the under-10-hour breach test is published with its environment spec, including patch levels and whether endpoint tooling was in blocking mode.
- Whether coding agent vendors report enforcement action against accounts used for exploit development.