AI Coding Agents Trip EDR Rules Built to Catch Hackers

What Sophos found

AI coding assistants are setting off endpoint security alarms that were designed to catch human intruders. Sophos examined seven days of Windows endpoint telemetry from June 2026. It found that Claude Code, Cursor and OpenAI Codex were repeatedly tripping behavioral detection rules tied to credential access, misuse of built-in system utilities, and persistence. 23 None of the activity was confirmed as malicious. Much of it, however, closely resembled known adversary techniques. 2

The analysis came from Sophos X-Ops and drew on the company's CIXA behavioral engine. 24 Rules mapped to the MITRE ATT&CK tactics of Credential Access and Execution generated the largest share of alerts. 2

The behaviors that raised flags

The most striking detections involved Windows' Data Protection API (DPAPI). One frequently triggered rule, labelled Creds_3b, watches for processes that use DPAPI to decrypt credentials stored in web browsers. 2 Sophos traced one instance to a /browse skill running under Claude Code, which ran PowerShell that called DPAPI to unlock saved browser data. 3 In context, that was almost certainly browser automation on the user's behalf. To the detection engine, it looked like credential theft, and Sophos argues the rule was correct to fire. 3

Other observed actions included enumeration of the Windows Credential Manager and writes to the startup folder. 1 Cursor tripped a persistence rule by using PowerShell to drop a script into the startup folder, so it would run on every boot. Sophos could not determine what that script did. Defenders typically flag startup-folder writes outside a trusted installer on sight. 3 The agents also used legitimate Windows binaries to download content, the classic living-off-the-land pattern that intruders favor because it blends into normal administration. 123

The most consequential detail is less any single action than how the agents respond to obstacles. When blocked, they try another route. Sophos points out that this pivot-when-blocked logic is precisely what has historically separated a live human attacker from a static, scripted tool. Benign agents now exhibit it too. 13

Why it matters for defenders

All the coverage agrees on the core finding. The emphasis shifts depending on the outlet. Some reports frame the problem mainly as alert noise. That noise could wear down analysts' trust in rules that were previously considered high-fidelity. 1 Others argue the deeper problem is attribution: distinguishing a sanctioned agent from an intruder doing the same things. 4 Security practitioners quoted in that reporting expect detection to lean more on context and intent than on behavior alone as agents grow more autonomous. 4

The two framings are linked. If a rule that fires on DPAPI browser-credential decryption becomes routine on developer machines, teams face an unpleasant choice. They can suppress it and create a blind spot an attacker could exploit. Or they can keep it and drown in false positives. An attacker who compromises a developer workstation could, in principle, hide inside the same patterns an agent produces every day. That risk is our inference rather than something Sophos documented, but it follows directly from the indistinguishability the research describes.

The practical advice so far is modest. Organizations should audit how AI agents are configured on endpoints. They should also disable permissive options, such as Claude Code's flags that bypass safety prompts. 1 Developers and security teams on Windows are the most directly affected, because behavioral rules there cannot currently tell agent activity from real attacks. 1

The tooling is starting to catch up

A nascent ecosystem is forming around agent visibility. Asymptote Labs' open-source Agent Beacon configures telemetry for runtimes such as Claude Code, Codex CLI, Cursor and Claude Cowork. It produces a normalized record of what each agent does across laptops, CI pipelines and cloud environments. 5 That kind of provenance data is the context that defenders say they need. 45 Meanwhile, agentic approaches are also being turned to defense. AgentGG, an Apache-licensed static analysis scanner, uses AI agents to trace imports and call graphs and confirm findings before reporting them. 5

Our read

The research does not show that AI coding agents are dangerous in themselves. It shows that a decade of behavioral detection rests on an assumption that no longer holds: that certain sequences of actions imply a human adversary. Agents that decrypt credentials, write persistence and route around blocks to finish a task have broken that assumption. The near-term fix is tighter agent configuration and better allowlisting. The longer-term fix is identity and intent signals attached to every agent action. Until that telemetry is standard, expect security teams to spend more time triaging their own developers' tools.