Russian hackers utilized AI coding assistant to compromise seven industrial firms

Russian-speaking threat actors leveraged the AI-powered coding assistant Cursor to facilitate unauthorized access to at least seven companies, including a Belgian chemical plant, between April and May 2026. The campaign, identified by Gambit Security, highlights the emerging risk of AI-assisted exploitation in industrial cyber-espionage. It remains unclear if the AI tool was specifically designed for malicious use or if its standard features were repurposed for vulnerability discovery.