AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
Summary: Sophos analyzed seven days of its own endpoint telemetry from June 2026 and found AI coding agents including Claude Code, Cursor, and OpenAI Codex triggering behavioral detection rules written for human intruders, with credential access at 56.2 percent of blocked activity and execution at 28.8 percent. The largest single rule, 42.6 percent of the credential-access group, fires when a process uses Windows' DPAPI to decrypt stored browser credentials, which Sophos observed via the GStack /browse skill running under Claude Code.
Bottom line: The behavior defenders rely on to spot intrusions is now produced by benign agents too, and CrowdStrike's 2026 report found 82 percent of 2025 detections were already malware-free. An agent running under a developer's trusted account should not inherit blanket access to credential stores, which is the line Sophos says to hold.
Read the original at The Hacker News ↗
- Topics
- Privacy
- Related
- Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent Cyber Risks · Nov 15, 2026