Ransomware gang bypassed AI guardrails by posing as red-team testers

Sophos reports that GOLD OGRE, the group behind Aur0ra ransomware, used Cursor-driven agents to escalate from credential access to domain admin, after first using a similar framework to test EDR evasion. Operators reportedly got past model guardrails by calling the work authorized red-teaming. Sophos assesses this with high confidence, though the models named and the three leak-site victims rest on its own account, and Gambit and CloudSEK's overlapping findings were not verified. Only one proxy IP overlaps. Sophos advises segmentation, isolated backups, and tighter domain admin privileges.