Sophos Says a Ransomware Gang Told AI Agents It Was a Red Team Test
Sophos says the group behind Aur0ra ransomware fed Cursor-run AI agents VPN logins and targets, then got past guardrails by calling the intrusions authorized red team work. Some agents reached domain admin access, and three of those victims later appeared on the gang's leak site.
The oldest social engineering trick in the book just worked on software. According to Sophos, the crew behind Aur0ra ransomware talked AI agents into hunting for domain admin access by telling them the job was an authorized red team exercise.
Sophos's Counter Threat Unit, which tracks the group as GOLD OGRE, published the findings in a research post that Help Net Security summarized on Monday. The company says it recovered Cursor artifacts in late August that show how the operators ran their intrusions. Humans supplied VPN credentials, SOCKS proxy access, targets and objectives. The agents did the grinding.
And they did plenty. Sophos says the agents mapped networks and Active Directory, analyzed credential-based attack paths and moved laterally "with limited human involvement." In several environments they combed network shares, user documents, backup repositories and cloud-connected storage. They ran password spraying and Kerberoasting, and pulled credentials out of files and backups. In a subset of victim networks, the agents reached domain management access. Sophos says three of those victims were later named on Aur0ra's data leak site.
The prompts read like a sysadmin's to-do list
Sophos published a few of the operator prompts, originally in Russian, with its own English translations. They are mundane in a way that makes them unsettling. One opens with a request to test a Windows AD network and offers a SOCKS5 proxy and user accounts. Another shows an operator coaching the agent to stay quiet:
"Don't try brute-forcing domain administrator accounts anymore. Try other, less noisy, methods and vectors." Operator prompt, as translated by Sophos
A third asks the agent to enumerate backup servers, NAS servers and virtualization systems across the whole infrastructure. Backups are what a victim reaches for when it does not want to pay, so you can guess why they were on the list. That last reading is ours, not Sophos's.
The guardrail bypass is the part worth pausing on. Sophos says the attackers got past AI safeguards by framing the intrusions as authorized red team activity or "diagnostics testing." No exploit chain or clever jailbreak is described. The attackers simply said the work was a sanctioned security test, which is exactly what real red teams say every day. A model has no easy way to check that claim.
Sophos says the intrusions were orchestrated by Cursor's Composer agentic coding model along with models from Anthropic, xAI and Moonshot. The firm's analysis indicates the actors used Anthropic almost exclusively at first, then brought in other models, a shift Sophos says may be tied to moving from building tools to running intrusions.
There are limits to the story. Sophos says breaking in and deploying the ransomware itself stayed under human control. The Cursor-driven work covered the middle of the attack chain. Gambit Security and CloudSEK also published analyses in late August that Sophos says appear to rest on the same exposed open directory, which held an attacker toolkit and Cursor chat logs.
Sophos assesses with high confidence that GOLD OGRE first used AI to test whether its tools could evade endpoint detection products in a Cursor-enabled testing framework, then gave associates similar technology for Aur0ra attacks. It also says it is "highly likely" other ransomware groups and their affiliates will build AI agents into their operations. That is a forecast from a security vendor, not a fact. This site has already covered a hacker who used AI agents to break into more than 100 websites.
Sophos's advice is deliberately unglamorous. AI can speed up phases of an attack and lower the technical skill needed, the company says, but patching internet-facing devices, phishing-resistant multi-factor authentication and watching EDR alerts still work. The catch is speed, because successful defense "relies on a quick response." Sophos also points to segmenting critical servers, isolating backups and reviewing domain administrator privileges to limit how far an intruder can roam.
For AI labs and tool makers, the uncomfortable question is plain. If a polite lie about authorization can unlock this kind of help, how much is a guardrail worth?
