The report
Sophos recovered Cursor traces associated with Aur0ra ransomware operators and found a workflow in which people supplied VPN access, proxy details, targets and objectives. Coding agents then helped search Active Directory environments, try credential paths and execute successive internal commands. In some of the investigated environments, the agent-assisted sequence reached domain management privileges. That is a stronger observation than simply finding an AI tool installed on an attacker's machine, but a narrower one than claiming that ransomware deployed itself.
Where the delegation began
The documented intrusion paths depended on access already supplied by human operators. Once connected, the agents could examine shares and systems, adapt commands after failures and propose subsequent moves. Sophos also describes a Cursor-based evasion-testing framework related to the Aur0ra operation. Tooling seen in separate research reports overlaps, but that overlap alone cannot attribute every reported campaign activity to the same model session or prove that an agent performed the encryption stage.
Sophos's technical account distinguishes captured prompts, recovered tooling and its own analytic assessment. The Aur0ra Case preserves these different evidence levels rather than assigning a single autonomy percentage.
An operational, not magical, advantage
A human-controlled agent can run many credential and network checks with less operator attention, but it still acts through the principal and host permissions supplied to it. Audit trails should therefore connect the original credential session, agent-issued commands and confirmed changes to directory roles, backups or data staging. Successful internal discovery is not itself proof of ransomware execution, and the incident report does not establish that every Aur0ra victim followed this workflow.