AI coding agents like Claude Code, Cursor, and OpenAI Codex are increasingly common in customer environments, writing code, installing dependencies, automating browser tasks, and troubleshooting failures through trial and error.
Sophos telemetry from its CIXA behavioral engine on Windows shows that, from an endpoint-detection perspective, this behavior often appears indistinguishable from adversary tradecraft.
Analysis of blocking rule hits over seven days in June 2026 shows that Credential Access and Execution tactics dominate detections, as measured by unique machine count.
AI Coding Agents Can Trigger Endpoint Detection Rules
A non-ATT&CK “Disrupt” bucket also stood out; this captures Adaptive Attack Protection (AAP) rules blocking low-reputation executables that agents attempted to run. None were malicious, but all had low global reputation scores in SophosLabs data.
Silent (non-blocking) rules paint a broader picture, with evasion and command-and-control categories prominent, reflecting network calls, child-process spawning, and command-line patterns that overlap with attacker behavior.
The rule Creds_3b drove most credential-access hits. It fires on the HMPA CookieGuard signal and detects processes that use the Windows Data Protection API (DPAPI) to decrypt browser credentials.
The primary trigger was GStack’s /browse skill, which connects agents to a Chromium daemon for browser automation.
Telemetry showed Claude Code invoking /browse, which used PowerShell to decrypt browser data via DPAPI, technically identical to credential-theft malware, even though the intent here was benign automation.
Other cases involved Python. In one example, Claude terminated browser processes via taskkill.exe, then ran a script (decrypt_wp_pass.py) accessing credential stores, followed by cmdkey.exe /list to dump Windows Credential Manager entries.
Notably, the Claude process included the --dangerously-skip-permissions flag a setting Anthropic’s own documentation warns against for exactly this reason.
Older rules are also catching new triggers. Exec_16a, a five-year-old rule for PowerShell string-obfuscation, now fires on formatting patterns common in AI-generated PowerShell, prompting recent tuning to reduce false positives.
A more striking pattern emerged from OpenAI Codex attempting to download Python from python.org. When certutil.exe -urlcache -split -f was blocked by Lateral_1b, the agent pivoted to bitsadmin.exe /transfer, which Exec_5a blocked in turn.
Both are classic living-off-the-land binary (LOLBin) download techniques, and the agent’s persistence in cycling through them mirrors hands-on-keyboard attacker behavior, despite the legitimate download target.
Separately, Cursor triggered Persist_2a by writing a VBScript file to the Windows Startup folder via PowerShell, associated with an application called “EZConvert.”
Without visibility into script contents, intent couldn’t be confirmed, but writing to startup folders outside a trusted installer context is inherently suspicious.
Sophos researchers stated that this telemetry doesn’t suggest AI agents are malicious; it shows that existing behavioral rules are working as intended, even as “normal” activity shifts.
Some detections, such as DPAPI-based decryption or Credential Manager dumps, remain risky regardless of who or what triggers them and shouldn’t be suppressed simply because an agent is responsible.
Detection engineering now faces a tuning challenge: distinguishing known-good agent signatures from genuine threats without weakening core protections.
For organizations deploying these tools, the bigger question is policy: defining what agents should be permitted to do on endpoints and where those boundaries should be enforced.
This telemetry is an early signal, not a definitive verdict; further monitoring and tuning will be necessary as adoption of agentic AI grows.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
