Key Takeaways
- AI coding assistants such as Claude Code, Cursor, and OpenAI Codex routinely trigger endpoint detection rules because their normal workflow mimics malicious behavior.
- The most common alerts involve credential access (especially decrypting browser credentials via DPAPI) and execution patterns that resemble “living‑off‑the‑land” techniques.
- Agents often exhibit adaptive, pivot‑when‑blocked behavior—switching tools when one is blocked—making them indistinguishable from human attackers to behavioral engines.
- Defenders should scope alerts by tying rules to the agent’s parent process, workspace paths, or download reputations, while retaining strict controls over credential‑store access.
- The rise of AI‑generated, malware‑free intrusions highlights a shifting threat landscape where behavior‑based detection must evolve to discern intent, not just action.
Overview of the Sophos Study
Sophos analyzed one week of endpoint telemetry from June 2026, focusing on Windows machines protected by its behavioral engine. The data were counted by unique machines rather than raw event volume, providing a snapshot of how often AI coding agents set off alerts designed to catch human intruders. Although the sample is limited to Sophos’s own fleet, the findings illustrate a growing friction between legitimate developer tooling and security defenses that rely on behavioral signatures.
Why AI Agents Trigger Alerts
The agents themselves are not malicious; they simply perform tasks that, to a detection engine, look identical to attack steps. Activities such as decrypting stored browser credentials, enumerating Windows Credential Manager, writing scripts to the startup folder, and downloading files with built‑in system utilities have long been high‑signal indicators of compromise. When an AI assistant carries out these actions in the course of normal coding assistance, the behavioral engine flags them as potential threats.
Breakdown of Detected Behaviors
Credential access accounted for 56.2 % of the blocked activity, while execution made up 28.8 %. The largest single credential‑access rule—responsible for 42.6 % of that group—fires when a process uses the Windows Data Protection API (DPAPI) to decrypt browser‑saved credentials. Sophos identified this pattern as the /browse skill of the GStack skill pack, commonly employed by Claude Code to automate browser interactions. To the engine, the action reads as credential theft, even though the agent is merely retrieving passwords for legitimate development work.
Credential Access and DPAPI Usage
In several observed cases, Claude Code shut down the running browser and executed a script that pulled data directly from the credential store. It also ran cmdkey /list to list the contents of Windows Credential Manager, notably while launched with the –dangerously-skip-permissions flag—a mode Anthropic’s documentation advises against and provides guidance for disabling. These actions demonstrate how the agent’s legitimate attempts to access needed secrets can appear identical to an attacker’s credential‑harvesting tactics.
Persistence Attempts and Startup Modifications
Cursor tripped a persistence rule by using PowerShell to drop a script into the startup folder, ensuring execution at each boot. Sophos could not verify the script’s purpose, but writing to startup outside a trusted installer is a classic red flag for malware establishing foothold. The agent’s behavior—creating a autorun entry to facilitate future automation—mirrors the technique used by threat actors to maintain long‑term access, prompting the same defensive response.
AI Agents on Both Offense and Defense
The phenomenon is not one‑sided. A month prior, Sophos documented an attacker who leveraged AI agents (including Claude Opus 4.5) to develop and test malware against EDR systems, using the agents as force multipliers during the development phase. Conversely, researchers have shown that a coding agent can be coerced into executing attacker‑supplied code via poisoned inputs, operating inside the user’s trusted session and thereby evading detection. Whether the agent is benign, attacker‑controlled, or hijacked, the observable actions—browser credential queries, LOLBin downloads, startup writes—remain the same, complicating attribution.
Broader Trend Toward Malware‑Free Intrusions
This behavior aligns with wider industry shifts. CrowdStrike’s 2026 Global Threat Report noted that 82 % of 2025 detections were malware‑free, with attackers relying on valid credentials and legitimate tools instead of dropping malicious files. Detection strategies consequently pivoted to behavioral analysis, seeking anomalies in how trusted utilities are used. AI coding agents now generate exactly those anomalies for perfectly benign reasons, crowding the signal that defenders once depended on to spot intrusions.
Practical Guidance for Defenders
To reduce noise, Sophos recommends tying detection rules to the agent’s provenance. Rules keyed to the parent process (e.g., claude.exe, cursor.exe) or to the agent’s workspace/temp directories can exclude ordinary assistant activity while still catching anomalous behavior. For execution‑focused alerts, limiting triggers to unusual PowerShell formatting or retry patterns helps scope the noise. Credential‑touching actions, however, should remain tightly controlled: decrypting browser credentials or enumerating Credential Manager must not be considered safe merely because an agent performed them. Disabling risky flags such as –dangerously-skip-permissions through managed policies is a concrete step defenders can take.
Conclusion and Open Policy Questions
Sophos stresses that its analysis is an early read, not a definitive verdict, yet the direction is clear: as AI‑assisted coding becomes ubiquitous, the line between legitimate automation and malicious intent blurs at the behavioral level. The core policy question emerging from this trend is what — if anything — a coding agent should be permitted to access on an endpoint, with credential stores representing a logical first boundary for restriction. Answering that question will shape the next generation of endpoint protection, balancing developer productivity with the need to detect genuine threats in an increasingly AI‑driven landscape.