Sophos reports Cursor AI agent abused for AD discovery and Kerberoasting

AI coding agents leave distinct forensic artifacts such as internal transcripts and non-interactive shell command wrappers rather than standard shell history. Attackers can exploit these agents using MCP servers, hooks, invisible Unicode in rules files, and tool descriptions. The post provides an agent triage kit and collection techniques for incident response teams investigating compromised development environments. Open article →