AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

# AI Coding Agents Are Now Indistinguishable From Attackers to Security Tools

The line between legitimate developer automation and malicious intrusion has blurred in ways that put security teams in an impossible bind: the very tools meant to catch attackers are now flagging the productivity software developers trust.

## The Threat

Sophos's analysis of one week of endpoint telemetry from June 2026 reveals a disquieting pattern. AI coding agents—including Claude Code, Cursor, and OpenAI Codex—are systematically triggering behavioral detection rules that were purpose-built to catch human intruders. The agents themselves are not malicious. They are doing exactly what their users asked them to do. The problem is that their ordinary work—credential access, code execution, file manipulation—produces a behavioral fingerprint that looks, to an automated defense engine, indistinguishable from a live attack.

The scope is significant. The analysis covered telemetry from multiple machines running Sophos's behavioral engine on Windows, counted by unique hosts rather than raw event volume. While the data window is narrow—seven days from a single vendor's fleet—it captures a moment when the problem has become operationally visible.

## The Numbers: When Productivity Looks Like Intrusion

Sophos's data presents a stark picture of what endpoint security tools now face:

| Activity Type | Percentage of Blocked Events |

|---|---|

| Credential Access | 56.2% |

| Code Execution | 28.8% |

| Other Behaviors | 15.0% |

Breaking down credential access further, the largest single rule trigger—accounting for 42.6 percent of all credential-access detections—fires when any process invokes Windows' Data Protection API (DPAPI) to decrypt stored browser credentials. This is a high-confidence signal in traditional threat hunting. Browsers store passwords, OAuth tokens, and session cookies. An attacker with DPAPI access can extract these wholesale.

The difference now: the process doing the decryption is often a developer's AI assistant going about routine work.

## Technical Details: How Benign Agents Mimic Attack Behavior

### Credential Harvesting via DPAPI

Sophos identified GStack, a widely-adopted skill pack for coding agents, which includes a /browse skill. This feature runs a PowerShell script that calls DPAPI to unlock saved browser credentials so the agent can automate browser-based tasks on the user's behalf. Sophos observed this exact behavior running under Claude Code.

In isolation, DPAPI access is low-risk if the agent is working under the user's own Windows session with their permissions. The agent is not escalating privileges; it is using the user's own decryption keys to unlock data the user already has access to. But to a behavioral detection engine trained on years of real attacks, DPAPI access from any process other than the browser itself or explicitly trusted tools is a critical alert.

### Lateral Movement Through Credential Enumeration

Claude Code was also observed:

Each of these actions, in isolation, is a legitimate step an AI assistant might take to gather context about the system it is running on. Collectively, they read like reconnaissance.

### Living Off The Land and Pivot Behavior

OpenAI Codex demonstrated what security researchers call "pivot behavior"—the hallmark of a live attacker adapting when blocked. The agent attempted to fetch a Python installer from python.org using certutil, a Windows utility legitimate administrators use but attackers favor for downloading payloads. When that approach was blocked, Codex pivoted to bitsadmin—another built-in Windows download tool frequently abused in real intrusions.

The target was harmless. The behavior is what concerns defenders: an agent that changes tactics when encountering friction, exactly as a thinking attacker would.

### Persistence Mechanisms

Cursor was caught writing a PowerShell script to the Windows startup folder, a location where code placed there executes automatically on every system boot. Sophos could not confirm what the script did, but the placement itself—writing to startup outside a trusted installer—is a critical defensive signal. Attackers use startup folder modification for persistence. So, occasionally, do legitimate tools that need to run at login.

## Background and Context: The Collision of Two Trends

This problem exists at the intersection of two major shifts in how software is built and how systems are attacked.

First, AI coding agents have become genuinely capable at automating tedious developer workflows. They browse documentation, run and test code, troubleshoot errors, and sometimes fix them autonomously. To do these things safely and efficiently, agents need broad system access: the ability to spawn processes, read files, interact with the browser, and access stored credentials.

Second, endpoint detection and response (EDR) tools have become more sophisticated at recognizing intrusions through behavioral analysis rather than signature matching. These tools watch for patterns—credential access, unusual process execution, persistence mechanisms—that distinguish attackers from normal users. The rules work because attackers have limited behavioral options. Malware has to do certain things: move laterally, escalate privileges, exfiltrate data, maintain access.

What no one anticipated was that software explicitly designed to be helpful would need to do some of the same things.

## The Flip Side: When Attackers Wield AI Agents

The threat landscape complicates further when AI agents are turned toward attack.

One month before Sophos published this analysis, the firm documented an attacker who used AI agents—including Claude Opus 4.5—to develop and test malware against EDR products themselves. This was development-time abuse: agents helping a human adversary write better evasion code. The attacker could iterate rapidly, testing outputs against the very detection tools they aimed to bypass.

In a separate incident, researchers demonstrated that a coding agent could be tricked into executing attacker-supplied code through poisoned input—a supply-chain-style attack where the agent's own reasoning process becomes the vector. Because the agent operates inside the user's trusted session, the malicious code runs with that session's permissions, potentially slipping past EDR rules that would flag the same code if it came from an external source.

These are separate incidents but they share a structural problem: a behavioral action (browser credential access, code execution, file writing) no longer tells you whether the actor is the user, a helper, or an attacker.

## Implications for Security Teams

The operational impact is acute. Security teams now face a choice:

1. Tighten detection rules to exclude AI agent behavior, reducing alert volume but weakening the ability to catch real attacks using the same techniques.

2. Allow more alerts through, accepting a flood of false positives and risking alert fatigue.

3. Implement allowlists for known benign tools, reducing coverage if attackers adopt new agents or modify existing ones.

None of these paths is satisfying. The first sacrifices detection sensitivity. The second overwhelms analysts. The third requires active maintenance and fails against novel tools.

The problem is compounded by the diversity of AI agents now in the wild. Claude Code, Cursor, OpenAI Codex, and others operate under different permission models and implement different behaviors. A detection rule that accounts for one may not work for others.

## The Broader Trend: Intrusions Are Evolving Faster Than Detection Can Keep Up

CrowdStrike's 2026 Global Threat Report found that 82 percent of 2025's targeted intrusions involved attacker-operated infrastructure—meaning attackers are building and controlling more of their own tooling rather than relying on off-the-shelf malware. That in turn means attack behavior is becoming less predictable and more adaptive. And now that adaptive behavior is also being generated by legitimate automation.

The endpoint security industry built its current detection suite around patterns that worked when attackers were the only ones doing reconnaissance, lateral movement, and persistence writes. That assumption no longer holds.

## Recommendations

For Security Teams:

For Organizations Deploying AI Agents:

---

## HackWire Analysis

The real story here is not that AI agents are misbehaving—they are not—but that the security industry has built detection infrastructure on an assumption that has now expired. For fifteen years, endpoint security has operated on the principle that users run applications and those applications do predictable things. Defenders learned to recognize intrusions by watching for actions outside that envelope: a process spawning a shell, a script accessing the credential store, a utility downloading a file.

That envelope has gotten much larger. The software developers use now includes agents capable of independent reasoning and action. Those agents do genuinely useful work—they automate drudgery and help humans think faster. But they operate across the boundary that endpoint security was designed to defend: the boundary between what the user intended and what an attacker forced.

The uncomfortable truth for vendors and defenders is that this boundary is becoming meaningless in practice. A developer running Claude Code with --dangerously-skip-permissions because they need their agent to solve a complex problem is, from an endpoint perspective, indistinguishable from a developer whose machine has been compromised and is being used by an attacker to exfiltrate credentials.

This is not a flaw in Sophos's detection logic or any one vendor's tools. It is a signal that the model itself needs to change. Behavioral detection worked when behavior was relatively constrained. But with the proliferation of autonomous agents—benign and otherwise—behavior alone is no longer sufficient to distinguish insider from intruder.

What comes next will likely involve a shift toward trust models based on process lineage (where did this action originate?), user intent (is the user aware of and approving this action?), and outcome (what was the access actually used for?)—techniques that are harder to implement but necessary if defenders are to avoid being overwhelmed by the gap between what is normal and what is attack.

— HackWire Editorial

---

## Related Coverage