Russian-speaking hackers are weaponizing Cursor AI for cyberattacks, Cisco Talos finds

Russian-speaking threat actors have been using Cursor, the AI-powered coding environment that SpaceX recently acquired for $60B, to build malware, automate attacks, and probe for vulnerabilities, according to a report from Cisco Talos published on August 4, 2026. The findings land at a particularly awkward moment for SpaceX, which closed its acquisition of Cursor’s parent company Anysphere just days later, around August 14. What Cisco Talos actually found The Cisco Talos report examined exposed AI prompt logs recovered from compromised systems. Those logs revealed that various threat actors, including Russian-speaking groups, have been feeding Cursor, alongside other AI coding assistants like Claude Code and Codex, prompts designed to generate malicious code, identify software vulnerabilities, and automate attack workflows. Russian-speaking individuals have been running these kinds of campaigns since at least 2025, according to the report. The operational pattern involves using commercially available AI coding platforms to prototype malware, streamline credential theft operations, and accelerate the discovery of exploitable weaknesses in target systems. The key distinction here is ...