Sophos Watched a Week of Endpoint Telemetry. 56% of the Blocked Activity Was Just Claude Code, Cursor, and Codex Doing Their Job.

Sophos X-Ops pulled seven days of June 2026 telemetry from its endpoint behavioral engine on Windows and found something uncomfortable: 56.2% of the blocking-rule hits tied to AI coding agents fell under Credential Access, and another 28.8% under Execution, the two MITRE ATT&CK categories defenders built specifically to catch human intruders. The agents doing the tripping were Claude Code, Cursor, and OpenAI Codex, running ordinary agentic coding sessions on real developer machines. I run one of these tools daily. This is the first research I've seen that puts hard numbers on a thing every agent user has half-noticed and shrugged off.

Why an EDR can't tell the difference

The core problem is structural, not a bug either side can quietly patch. Coding agents need local filesystem and shell access to do their job: read configs, run commands, install dependencies, troubleshoot by trying a different tool when the first one fails. Attacker tradecraft, especially post-2024 "living off the land" tradecraft, looks almost identical: legitimate system binaries used for illegitimate ends, no dropped malware, just normal-looking commands run in a sequence a human wouldn't run by hand.

Sophos's own numbers make the overlap concrete. The single biggest credential-access rule, responsible for 42.6% of that bucket, fires when a process uses Windows' Data Protection API to decrypt browser-stored credentials. Sophos traced that to GStack, a widely adopted AI agent skill pack, whose /browse skill runs PowerShell through DPAPI to decrypt saved browser data, invoked in this case by Claude Code doing browser automation on the user's behalf. In a separate example, Claude Code killed running browser processes, ran a Python script that pulled data from the credential store, then ran cmdkey.exe /list to enumerate Windows Credential Manager (notably with --dangerously-skip-permissions set, a flag Anthropic's own docs warn admins to block). None of that is malware. All of it is exactly what the rule exists to catch.

Execution told the same story from a different angle. OpenAI Codex tried to fetch a Python installer from the real python.org using certutil.exe, got blocked, and pivoted to bitsadmin.exe, two legitimate Windows utilities that are also textbook attacker download tools. Cursor tripped a persistence rule by writing a PowerShell-generated script into the Windows startup folder. Sophos couldn't confirm intent on that one either way, which is itself the point: from the telemetry alone, benign and malicious look the same.

The two-sided risk

The obvious risk is your own agent getting killed mid-task by a false positive, which is annoying but recoverable. The less obvious one is scarier. A month before this research, Sophos separately documented an attacker using AI agents (including one running Claude Opus 4.5 to coordinate the workflow) to build and iteratively test malware against Sophos, CrowdStrike, and Windows Defender EDR agents inside a lab environment, developing close to 80 payload-generation modules across more than 70 evasion techniques. Humans still drove the actual attack-development loop, but AI cut the iteration time.

Separately, researchers at Tenet Security disclosed an attack called Agentjacking: inject a crafted fake error into Sentry (the error-tracking tool many teams already wire into their agent's context) using nothing more than a public write-only DSN key, and a coding agent asked to "fix the Sentry issue" will read the attacker's instructions as legitimate guidance and execute them with the developer's own privileges. Tenet found over 2,388 organizations with exploitable DSNs exposed and reported an 85% success rate against the agents they tested. Their framing is blunt: this bypasses EDR, WAF, and firewalls, because nothing in the chain is technically unauthorized: the agent is acting inside a session you already trust.

Put those two together and you get the actual shape of the problem. Attackers are using agents as tools, and attackers are using your own agent's trusted local access as camouflage. Meanwhile your antivirus is watching a huge new source of behavior that looks like both.

What a solo dev should actually do

I'm not going to tell you to turn off your antivirus, and Sophos isn't either: their own conclusion is that some of what they caught (DPAPI credential decryption, Credential Manager enumeration, unexplained startup-folder writes) is worth flagging no matter who or what triggered it. The useful move is narrower: separate the categories of agent action by how reviewable they are, not by which agent produced them.

Anything that touches credential stores (password managers, browser-saved logins, cmdkey, keychain access, environment files with live API keys) deserves a manual look before you let an agent run it unattended, especially with permission checks disabled. That's not paranoia; it's the same rule Sophos is telling enterprise SOCs to hold the line on. Execution noise (odd PowerShell formatting, an agent retrying a failed download with a different tool) is genuinely lower stakes and mostly a false-positive tuning problem, not a security one. If your own EDR or antivirus is scoped by process parent (claude.exe, cursor.exe) and workspace path, most of that noise goes away without loosening anything that matters. And if you're piping external, attacker-reachable data into your agent's context (Sentry errors, GitHub issues, scraped web content, MCP tool output), treat that ingestion path as untrusted input, the same way you'd treat unsanitized user input in a web form, because Agentjacking exists precisely because nobody was doing that.

The specific --dangerously-skip-permissions flag is worth naming directly: Anthropic ships a warning with it and gives admins a way to block it in managed settings. If you're running it on your only machine because reviewing every tool call is annoying, you've traded a minor daily friction for exactly the blast radius Sophos and Tenet both describe.

The honest counter-take

Sophos is explicit that this is "an early read, not a verdict," seven days from one vendor's fleet, counted by unique machines, not an industry census. It's possible this settles down fast: agent vendors ship recognizable process signatures, EDR products add agent-aware allowlisting, and in six months this reads like a transitional-year problem rather than a permanent one. Detection engineering has absorbed weirder shifts before. I'd also push back gently on how alarming the Agentjacking numbers sound in isolation: an 85% success rate against a researcher's own controlled test isn't the same as an 85% real-world compromise rate, and Sentry has already shipped a content filter against the specific payload string Tenet used.

But the structural tension doesn't go away just because the specific exploits get patched. As long as agents need real local access to do real work, and as long as behavioral EDR is the main defense against credential-free, tool-abusing intrusions, some fraction of legitimate agent activity is going to keep looking like an attack. The rules that matter (credential store access chief among them) shouldn't get quietly whitelisted just because the noise is annoying.

Author

Lukas

@lukcombinator

Sources

• AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers: The Hacker News
• When AI agents look like attackers: what behavioral telemetry tells us: Sophos X-Ops
• Pointing a Cursor at evading detection: Sophos Counter Threat Unit
• Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code: The Hacker News