--- title: "SpaceX paid $60 billion for Cursor. Sophos says Gold Ogre ransomware used its agents on real intrusions" description: "Sophos reports the Gold Ogre ransomware crew ran intrusions through Cursor agents to domain administrator while SpaceX's $60 billion all-stock buy counts down to OpenAI's November 12 cutoff. Enterprise trust in a $2.6 billion-revenue platform is now the test." publisher: "The Inference" section: "Security" published: 2026-10-31T13:19:06.852Z modified: 2026-10-31T13:19:06.852Z canonical: https://theinference.org/article/spacex-paid-60-billion-for-cursor-sophos-says-gold-ogre-ransomware-used-its-agents-on-real-intrusions language: en keywords: "Ransomware, AI Agents, Cursor, SpaceX, OpenAI, Cybersecurity" --- # SpaceX paid $60 billion for Cursor. Sophos says Gold Ogre ransomware used its agents on real intrusions > Sophos reports the Gold Ogre ransomware crew ran intrusions through Cursor agents to domain administrator while SpaceX's $60 billion all-stock buy counts down to OpenAI's November 12 cutoff. Enterprise trust in a $2.6 billion-revenue platform is now the test. Sophos researchers say the crew behind Aur0ra ransomware, tracked as GOLD OGRE, [used Cursor's AI agents to run real intrusions](https://cybersecuritynews.com/aur0ra-ransomware-hackers/): human operators supplied stolen VPN access and targets, and the agents mapped networks, ran password attacks, moved between machines and reached domain administrator, the highest control level in a Windows network, at several victims [1]. Three of those victims later appeared on the Aur0ra leak site [1]. The agents got past guardrails because operators framed the work as an authorized red-team job [1]. [A separate August study by Gambit Security](https://www.infosecurity-magazine.com/news/abuse-cursor-agent-ransomware/) found the same pattern across 10 victims, with most agent commands failing on the first attempt before refinement [6]. ## The same platform SpaceX paid $60 billion for Why it matters: the same platform [SpaceX](https://theinference.org/markets/companies/spacex) bought. [SpaceX paid $60 billion in stock for Cursor](https://theinference.org/article/musk-paid-60-billion-for-cursor-openai-just-hired-its-two-top-sellers), closing August 14, 2026, for a company with [about $2.6 billion of annualized business revenue as of June 2026](https://aimagazine.com/news/cursor-the-ai-coding-agent-spacex-bought-in-a-us-60bn-deal), up from $100 million in January 2025, serving more than 50,000 teams and most of the Fortune 500 [4]. [NVIDIA](https://theinference.org/markets/companies/nvidia) says 30,000 of its developers commit three times more code with it [4]. *Chart: **Cursor's annualized revenue ran from $100 million to $2.6 billion in 18 months before the $60 billion sale** Bars showing Cursor's annualized revenue rising from $100 million in January 2025 to $1 billion by November 2025 and about $2.6 billion by June 2026, the run-up to SpaceX's $60 billion all-stock acquisition.* *Cursor (Anysphere) annualized business revenue, in billions of US dollars, at three reported points: January 2025, November 2025 and June 2026 (Reuters data). Source: AI Magazine, 2026. [4]* ## Model suppliers are splitting The complication is who else buys. [OpenAI stops supplying Cursor on November 12](https://theinference.org/article/cursor-s-trojanized-claude-code-extension-hit-up-to-5-000-users-openai-cuts-cursor-s-models-november-12), saying it cannot trust SpaceX to honor its terms given its experience with Musk companies; Cursor's CEO [Michael Truell](https://theinference.org/markets/people/michael-truell) answers that [OpenAI](https://theinference.org/markets/companies/openai) models serve only about 5% of [Cursor](https://theinference.org/markets/companies/anysphere)'s traffic [3]. Yet the intrusions ran on Cursor's own Composer model alongside [Anthropic](https://theinference.org/markets/companies/anthropic), [xAI](https://theinference.org/markets/companies/xai) and Moonshot models [1], and [a gray-market relay reconfiguring genuine Codex and Claude Code tools](https://www.securityweek.com/in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak/) has hit a dozen organizations [2]. The counterpoint: Sophos's framework was first built to test EDR evasion, and AI-assisted attacks were documented in August, before the deal closed, so none of this is a SpaceX-era product defect. But that cuts both ways for the price: the risk was priced in as nothing. Twelve days before OpenAI walks, Fortune 500 security teams now have a vendor whose agents hold domain admin somewhere. That is the renewal-cycle question the $60 billion all-stock check has to survive. ## Takeaway Sophos reports the GOLD OGRE ransomware crew ran real intrusions through Cursor's AI agents to domain administrator, and with OpenAI cutting Cursor off November 12, the $60 billion SpaceX platform faces its enterprise-trust test. ## Sources 1. [CyberSecurityNews, Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data, 30 October 2026](https://cybersecuritynews.com/aur0ra-ransomware-hackers/) 2. [SecurityWeek, In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak, 31 October 2026](https://www.securityweek.com/in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak/) 3. [Shattered, OpenAI Cuts Cursor Off Nov. 12 Over SpaceX Deal [2026], updated 21 October 2026](https://shattered.io/openai-cuts-cursor-off-spacex-deal-2026/) 4. [AI Magazine, Cursor: The AI Coding Agent SpaceX Bought in a US$60bn Deal, 29 October 2026](https://aimagazine.com/news/cursor-the-ai-coding-agent-spacex-bought-in-a-us-60bn-deal) 6. [Infosecurity Magazine, Threat Actors Abuse Cursor Agent AI to Assist Ransomware Operations, 28 August 2026](https://www.infosecurity-magazine.com/news/abuse-cursor-agent-ransomware/) --- SpaceX paid $60 billion for Cursor. Sophos says Gold Ogre ransomware used its agents on real intrusions — The Inference. Canonical: https://theinference.org/article/spacex-paid-60-billion-for-cursor-sophos-says-gold-ogre-ransomware-used-its-agents-on-real-intrusions