Hackers Turned Cursor's AI Coding Assistant on Seven Firms

Russian-speaking cybercriminals used Cursor, the AI coding assistant owned by SpaceX, to help break into a Belgian chemical company and at least six other firms earlier this year, according to data reviewed by Reuters and reports published Thursday by cybersecurity firms Gambit Security and CloudSek.

An AI coding assistant built to speed up software development has been used to speed up something else. Russian-speaking cybercriminals leaned on Cursor, the AI coding tool owned by SpaceX, to help break into a Belgian chemical company and at least six other firms earlier this year, according to data reviewed by BNN Bloomberg reporting on a Reuters exclusive, alongside reports issued Thursday by the cybersecurity companies Gambit Security and CloudSek.

Seven companies were hacked in total. The Belgian chemical maker is the only victim identified by sector in the accounts; the others were not named. The intrusions took place earlier this year, meaning the forensic work behind Thursday's reports arrives well after the fact — a lag that is itself part of the story for corporate security teams.

Why a coding assistant is a useful tool for an intruder

An AI coding assistant is software that sits inside a developer's editor and writes, completes or rewrites code on request. It can also read a codebase, explain what it does, and suggest changes. Cursor is one of the best-known products in that category, and it is now owned by SpaceX.

The same capabilities that make such a tool valuable to a legitimate engineer make it valuable to an attacker. Reconnaissance on unfamiliar code, writing small utilities to move data, adapting a script to a target's particular stack, translating between languages and frameworks — all of that is labor that used to require a skilled human and now requires a prompt. Nothing in the reported facts suggests Cursor was breached or that a flaw in the product was exploited. The point is simpler and harder to fix: a general-purpose productivity tool was pointed at a criminal task.

That distinction matters for how enterprises should respond. There is no patch for a tool being used competently by the wrong person. The mitigations are on the vendor side — abuse detection, account-level controls, refusal behavior — and on the defender side, where the assumption that a low-resourced crew cannot produce polished, targeted code no longer holds.

The economics of intrusion are shifting

For years the practical ceiling on cybercrime was talent. A group could buy access, buy malware, buy a ransomware kit, but adapting all of that to a specific victim's environment took engineers. AI assistants compress that step. A crew that previously had to recruit or rent expertise can now generate a workable equivalent, faster, and iterate on it when defenses push back.

The consequence is not necessarily more sophisticated attacks at the top end — state-linked operators already had the engineering. It is a thicker middle: more groups capable of the kind of tailored work that used to separate serious operators from opportunists. Seven companies from a single documented campaign is a small number in absolute terms, but the significant figure here is not the victim count. It is the demonstration that the workflow functions.

What the chemical-sector target signals

Industrial manufacturers are a recurring target for a reason. They combine valuable process intellectual property, complex operational technology that is expensive to take offline, and supply-chain relationships that give an intruder onward reach. A chemical company also tends to have a wide vendor footprint — contractors, engineering firms, logistics partners — each one a potential entry route and each one outside the victim's direct control.

European industrial firms have been dealing with elevated threat activity for some time, and the presence of a Belgian chemical producer in this set fits that pattern rather than breaking from it. For boards in the sector, the practical questions are unglamorous: how quickly would an intrusion be detected, how segmented is the plant network from the corporate one, and how much of the response plan depends on a vendor who is also a target.

Where the pressure lands on AI vendors

Two things typically follow a report like this. The first is product change — tighter monitoring for patterns consistent with intrusion work, faster account termination, more logging retained for investigators. The second is political. Regulators in Europe and the United States have been looking for concrete misuse cases to anchor rules on AI accountability, and a named tool used in a documented set of breaches is exactly the kind of case that gets quoted in hearings.

SpaceX is privately held, so there is no share price to register the news. That is the tidy part for investors and the awkward part for accountability: the reputational cost of a misused tool falls on a company whose ownership structure insulates it from the daily market judgment that a listed software vendor would face. Publicly traded security and software names, by contrast, tend to absorb these episodes through customer questions rather than immediate price action.

The broader tape gave no sign of concern. The S&P 500 tracker (NYSEARCA: SPY) closed at $771.10, up 0.66% on the day from a prior close of $766.08, in the session ended Thursday, Aug. 27, 2026 at 20:00 GMT. The Nasdaq 100 proxy (NASDAQ: QQQ) finished at $721.11, up 1.37%, and the Dow tracker (NYSEARCA: DIA) at $535.22, up 0.19%. AI-linked equities have been the market's engine, not its liability, and a misuse report about a coding assistant is not the kind of event that changes that.

What security teams should be watching next

Three things are worth tracking from here. First, whether Gambit Security, CloudSek or other researchers tie additional victims to the same activity — campaigns identified after the fact usually grow. Second, whether the tooling shows up in ransomware operations rather than quieter intrusions, which would raise the cost profile sharply. Third, what controls AI vendors disclose in response, and whether those controls are auditable by enterprise customers or simply asserted.

For defenders the immediate work is not exotic. Identity and access hygiene, network segmentation between corporate and plant systems, and third-party access reviews all still carry more weight than any AI-specific countermeasure. What has changed is the tempo. If an attacker can produce customized code in an afternoon, a detection window measured in months is not a window at all.

Key facts

• Companies breached: Seven, including a Belgian chemical company
• Tool involved: Cursor, the AI coding assistant owned by SpaceX
• Reports published: Thursday, by Gambit Security and CloudSek; data reviewed by Reuters
• Market context (close, Aug 27, 2026, 20:00 GMT): QQQ $721.11 (+1.37%); SPY $771.10 (+0.66%)

Frequently asked questions

What is Cursor and who owns it?

Cursor is an AI coding assistant — software that sits inside a developer's code editor and can write, complete, explain or rewrite code on request. It is owned by SpaceX. In this case it was reportedly used by Russian-speaking cybercriminals to assist intrusions rather than being itself hacked or exploited through a flaw.

How many companies were affected?

Seven companies in total were hacked, according to data reviewed by Reuters and reports issued Thursday by cybersecurity firms Gambit Security and CloudSek. One of them was a Belgian chemical company; at least six other firms were also compromised. The remaining victims were not identified by name or sector in the reports.

Was Cursor itself breached?

Nothing in the reported facts indicates the product was breached or that a vulnerability in it was exploited. The concern is misuse: attackers used a legitimate, general-purpose productivity tool to help perform reconnaissance and write or adapt code for criminal purposes. That is a policy and abuse-detection problem for the vendor, not a software patch.

Why does AI-assisted hacking matter if the victim count is small?

Seven victims is modest in absolute terms. The significance is that the workflow demonstrably works. AI assistants lower the engineering skill needed to tailor an attack to a specific target, which widens the pool of groups capable of doing work that previously required hired expertise. That raises the volume of credible threats defenders face.

Can investors trade this news?

Not directly through the company at the center of it. SpaceX is privately held and has no listed shares, so there is no market price to react. Broad indexes closed higher on Aug. 27, 2026, with the Nasdaq 100 tracker QQQ up 1.37% at $721.11, showing no sign of concern in AI-linked equities.

What should companies do about AI-assisted attacks?

The defensive fundamentals do not change: identity and access controls, segmentation between corporate and industrial networks, and reviews of third-party and contractor access. What changes is speed. If attackers can generate customized code quickly, detection windows measured in months are inadequate, and response timelines need to shorten accordingly.

Sources

• Russian-speaking cybercriminals used SpaceX’s Cursor AI tool to hack seven companies: Reuters exclusive — BNN Bloomberg

Photo: Rahul Pandit · Pexels Licence — source