Sophos pulled a week of endpoint telemetry in June 2026 and found something that should worry anyone who has quietly let engineers loose with AI coding agents: the agents keep tripping detection rules that exist specifically to catch human intruders. Sophos published the analysis on its blog, and The Hacker News covered the findings on 8 July. Neither Claude Code, Cursor nor OpenAI Codex were doing anything malicious. They were doing their jobs. The problem is that their jobs, mechanically, look a lot like an attack.
What actually tripped the alarms
Sophos's breakdown of a week's worth of blocked and flagged activity is specific enough to be genuinely useful. Credential-access behaviour accounted for the majority of alerts, 56.2% of the blocked activity in the sample, and within that category, agents decrypting stored browser credentials via the Windows Data Protection API made up 42.6% of credential-access alerts on its own. Enumerating what sits in Windows Credential Manager with a plain cmdkey /list was common enough to register clearly, and in several cases Claude Code had been run with the --dangerously-skip-permissions flag, removing the one guardrail most likely to have stopped the behaviour before it started.
Execution-category alerts made up 28.8% of the sample, and two specific incidents stand out because they show agents adapting in ways that read, to a defender, exactly like an attacker probing for a way through. OpenAI Codex tried to fetch a Python installer using certutil, a living-off-the-land binary defenders have watched attackers abuse for years; when that was blocked, it pivoted to bitsadmin instead, which is precisely the kind of tool-switching behaviour a SOC analyst is trained to treat as evidence of intent. Cursor separately tripped a persistence rule by writing a PowerShell script into a startup folder so it would run again on reboot, again a textbook technique, just performed by a tool trying to keep a long-running task alive rather than an intruder trying to keep a foothold.
Why the overlap is structural, not a training problem
It's tempting to read this as a case of agents needing better guardrails, and to some extent that's true. But the deeper issue is that the actions themselves, credential decryption, credential store enumeration, installer downloads via system utilities, startup-folder persistence, are privileged operations that carry no reliable signal of intent in their raw form. A behavioural detection engine sees the operation, not the reason for it. An agent legitimately restoring a saved API key from a browser's credential store and an attacker harvesting the same credential for exfiltration generate close to identical telemetry. That was true before agentic coding tools existed; it has simply gone from a rare edge case to routine background noise now that agents run these operations dozens of times a day across an engineering organisation.
This is also why the fix isn't "make the agent behave more like a human developer." Human developers rarely decrypt stored browser credentials or enumerate the credential manager as part of normal work, precisely because those are unusual, occasional actions for a person. An agent that needs to retrieve a saved token to complete a task will do it every time the task requires it, which is exactly the pattern that turns a rare high-signal alert into routine noise a SOC either has to tune out or drown in.
The detection engineering problem this creates
Every SOC that has spent years tuning behavioural rules against a baseline of human activity now has a second population generating activity at a completely different volume and cadence, and no easy way to tell the two apart from the telemetry alone. Tune the rules to tolerate agent behaviour and you widen the gap an actual attacker can walk through unnoticed. Leave the rules as they are and analysts either drown in false positives from legitimate agent activity or, more dangerously, start reflexively dismissing credential-access and persistence alerts because "it's probably just Cursor again." That second failure mode is the one that should worry security leaders most, because it is exactly the kind of alert fatigue that has historically preceded real breaches going unnoticed.
What Sophos recommends, and what we'd add
Sophos's own guidance is sensible and immediately actionable: scope execution rules by parent process and workspace path so that an agent's process tree is distinguishable from an interactive shell; keep credential-access protections in place regardless of which process is asking, since the sensitivity of the credential doesn't change based on who wants it; and disable dangerous-permission modes, like Claude Code's skip-permissions flag, through managed configuration rather than leaving it to individual developers to decide when it's convenient. We'd add one more: treat "which AI coding agents are in use, and with what permissions" as an inventory question your security team actually owns, not something that gets discovered retroactively when telemetry looks strange. Most organisations that have this problem today don't have it because engineering hid the tools from security; they have it because nobody thought to ask.
What this means if you're rolling out coding agents at scale
None of this is a reason to slow down AI coding agent adoption, and Sophos isn't arguing for that either. It is a reason to treat the rollout as a detection engineering project alongside the productivity one. Before agents are approved for broad use, security and platform engineering teams should agree on the process signatures, workspace boundaries and permission defaults that let a SIEM tell "the agent doing its job" from "someone using the agent's access to do something else," because relying on human judgement to make that call alert-by-alert doesn't scale past a handful of engineers.
Practical steps for the next quarter
- Inventory every AI coding agent in active use, including which ones run with elevated or permission-bypassing flags.
- Scope behavioural detection rules by parent process and workspace path rather than by action alone.
- Keep credential-access protections at full sensitivity; do not create blanket exceptions for known agent processes.
- Disable dangerous-permission or skip-confirmation modes by default through managed policy, not developer choice.
- Brief your SOC explicitly on agent-generated telemetry patterns so genuine anomalies don't get lost in the noise.
- Revisit detection rule tuning quarterly as agent usage and vendor tooling both continue to change quickly.
The uncomfortable truth in the Sophos data is that the industry spent years building detection rules around the assumption that privileged, credential-touching activity was rare and therefore meaningful. Agentic coding tools have quietly broken that assumption, and the organisations that adapt their detection engineering to match will be the ones still able to trust their alerts when it actually matters. Want a second opinion on your detection coverage against agentic AI tooling? Email sales@halfteck.com.