Elon Musk's SpaceX paid $60 billion for Cursor and inherited a Russian hacker problem that hit seven companies

Elon Musk's SpaceX closed the largest startup acquisition in history on August 14, paying $60 billion in all-stock consideration for Anysphere, the parent company of AI coding assistant Cursor. Days before the transaction closed, Reuters reported that Russian-speaking hackers had already turned Cursor into a weapon against at least seven companies, and SpaceX inherited every piece of that problem the moment the deal became effective.

The acquisition, announced June 16 and structured as an all-stock merger that converted Anysphere shares into approximately 391 million SpaceX Class A shares, folds Cursor into a new SpaceXAI division alongside Grok. The coding tool reached approximately $4 billion in annualized revenue by June 2026, up from $1 billion a year earlier, making the $60 billion price tag roughly 15 times revenue, one of the largest multiples ever paid for an AI software company.

How the hackers got in

The Aurora ransomware group did not breach Cursor through conventional means. Researchers uncovered more than two dozen conversations in which attackers falsely described their intrusions as authorized security simulations and persuaded Cursor's AI agent to hunt for credentials on their behalf. When the tool refused malicious commands, the attackers simply restarted sessions until they received a compliant response.

The method exposed a fundamental weakness in session-level guardrails that reset with each new conversation. Identified victims included Belgium's Christeyns, Germany's Teckentrup and Louisiana-based Bayou Title. The underlying model powering the campaign was Anthropic's Claude Sonnet 4.5, a dependency SpaceX now inherits but did not build and cannot fully control.

What SpaceX owns now

SpaceX did not own Cursor when the breaches occurred and there is no evidence management knew about the campaign before closing. The remediation work, however, lands entirely on SpaceX at a valuation that assumes Cursor is a competitive differentiator rather than a reputational liability.

SpaceX president Gwynne Shotwell addressed the acquisition on the company's second-quarter earnings call, saying the company was "looking forward to welcoming the Cursor team to SpaceX to integrate our engineering and begin to benefit from a combined sales capability." Musk tied Cursor directly to Grok's product roadmap. Neither addressed the company's security posture.

The competitive landscape shifted further when OpenAI ended its partnership with Cursor following the SpaceX acquisition, narrowing the AI model options available to Cursor's development team. Cursor's market share in AI coding tools had already slipped from approximately 41% in June 2025 to roughly 26% by May 2026 even as revenue grew, a paradox that points to a market expanding faster than any single tool can hold.

Scale puts the risk in context

SpaceX generated $7.81 billion in revenue in the second quarter of 2026, a 92% year-on-year increase, doubled Starlink subscribers to 12 million and finished the period with $100 billion in cash. At those numbers, Cursor is a rounding error on the balance sheet. It is not a rounding error on reputation.

The company manages $18.4 billion in quarterly capital expenditure and a $47.5 billion project backlog. Enterprise customers buying Cursor seats for engineering teams need the product to consistently reject malicious prompts, not just on the first attempt. The acquisition thesis depends on that working reliably, and the Aurora breach demonstrated it does not yet.

Cursor's team now has access to SpaceX's Colossus supercomputer in Memphis, described as housing approximately 200,000 Nvidia GPUs with plans to scale toward one million, giving the SpaceXAI division the compute infrastructure to rearchitect session-level controls at a scale no independent startup could have funded.

Analyst consensus sits at a $219.22 price target for SpaceX shares, with 27 buy ratings and two sells. SpaceX shares closed at $141.50 on the day the source article was published, up 25.72% over the prior month, suggesting the market has not yet fully priced in the trust problem attached to a product valued in the fifteen figures.