AI Tools Claude, Cursor, and Codex Trigger Endpoint Security Rules

Key Takeaways

• AI coding assistants like Claude Code, Cursor, and OpenAI Codex are triggering endpoint security alerts for activities resembling credential theft and living-off-the-land (LOTL) attacks.
• Sophos telemetry from June 2026 revealed these tools performing actions such as decrypting browser credentials, enumerating saved credentials, and using native Windows utilities (LOLBins) for downloads.
• While the observed activities were not confirmed as malicious, they closely mimic established attacker techniques, posing a significant challenge for security teams in distinguishing benign AI automation from genuine threats.
• The use of flags like “–dangerously-skip-permissions” and persistence mechanisms further blurs the line between legitimate development operations and suspicious behavior.
• Organizations must implement robust policies and enhance visibility into AI agent activities to prevent false positives while maintaining strong security postures.

AI Coding Agents Mimic Malicious Behavior, Triggering Enterprise Security Alarms

In a concerning development for enterprise cybersecurity, popular AI coding agents such as Claude Code, Cursor, and OpenAI Codex are inadvertently setting off endpoint security systems by engaging in activities typically associated with sophisticated attackers. New telemetry data indicates these tools are frequently triggering detections related to credential access and the misuse of legitimate system tools, known as living-off-the-land binaries (LOLBins).

Analysis conducted by Sophos’ CIXA behavioral engine underscores how the operational patterns of these AI tools increasingly blur the distinction between acceptable automated tasks and actions characteristic of malicious actors. This convergence presents a significant challenge for security operations centers (SOCs) tasked with identifying genuine threats amidst a rising tide of AI-driven activity.

The findings, based on Windows endpoint telemetry gathered over a seven-day period in June 2026, show a high volume of alerts mapped to MITRE ATT&CK tactics, particularly “Credential Access” and “Execution.” Although no malicious intent was confirmed in the observed instances, many of the flagged behaviors bore striking resemblances to known adversary techniques.

Credential Access Detections Dominate

A substantial portion of the security alerts stemmed from behaviors associated with credential access. One of the most frequently activated rules, designated “Creds_3b,” flags processes that utilize the Windows Data Protection API (DPAPI) to decrypt credentials stored by web browsers. This specific behavior was repeatedly observed when AI agents performed browser automation tasks, often leveraging tools like the GStack skill pack.

For instance, an AI agent’s “/browse” capability could initiate a series of processes that eventually invoke PowerShell to decode protected data. In one specific command, PowerShell was seen employing .NET cryptographic functions to decode Base64 input and then decrypt it using DPAPI under the current user’s context. As Sophos researchers noted that, despite being a legitimate action for browser automation, this technique is a well-known method used by information stealers, leading to its accurate detection by security rules.

Other credential-related alerts involved Python scripts launched by AI agents. In some scenarios, agents would terminate browser processes using “taskkill” before executing scripts designed to access stored credentials. Additionally, commands were observed where the native Windows utility “cmdkey” was used to enumerate saved credentials. Such actions, particularly when combined with potentially risky flags like “–dangerously-skip-permissions” (which Claude Code documentation specifically warns about), would typically prompt an immediate and thorough investigation by a security operations center.

LOLBin Abuse and Persistence Mechanisms

Beyond credential access, AI agents also triggered alerts related to command-line obfuscation and the abuse of LOLBins. One notable example involved OpenAI Codex attempting to download a Python installer from its official source using “certutil.exe.” When this attempt was blocked by security policies, the agent demonstrated adaptive behavior, pivoting to “bitsadmin.exe”—another legitimate Windows utility frequently exploited by attackers. This retry logic closely mirrors the “hands-on-keyboard” tactics of human adversaries, who often experiment with multiple techniques until one succeeds.

Persistence mechanisms were also detected. In one instance, the Cursor agent utilized a PowerShell script to embed a VBScript file into the Windows startup folder. This action, while potentially related to application setup, was flagged by persistence detection rules, as writing to startup locations outside of trusted installers is considered a high-risk behavior.

The telemetry data also encompassed detections under a “Disrupt” category, representing Adaptive Attack Protection (AAP) events. These events were triggered when AI agents attempted to execute binaries with a low reputation. Although these files were not confirmed to be malicious, their lack of a global reputation led to automated blocking by endpoint protection systems.

Collectively, these observations highlight a fundamental shift in baseline endpoint activity. Actions once considered strong indicators of compromise are now being performed by legitimate, AI-driven automation tools. However, the inherent risk profile of these behaviors—decrypting credentials, using LOLBins for downloads, and modifying persistence locations—remains unchanged. This presents a complex challenge for security engineers: how to evolve detection mechanisms to differentiate between trusted AI automation and genuine threats without compromising security efficacy. As AI agents become more autonomous, organizations must establish clear policies defining their permissible actions and enhance visibility into their operational footprint to effectively manage this evolving threat landscape.

What You Should Do

• Implement strict policies for AI agent deployment, clearly defining permitted actions and access levels within the enterprise environment.
• Enhance endpoint detection and response (EDR) visibility into processes spawned by AI agents, focusing on behaviors like credential access, LOLBin usage, and persistence modifications.
• Regularly review and fine-tune security detection rules to reduce false positives while maintaining coverage for known adversary techniques, adapting to the unique patterns of AI agent activity.
• Educate development and IT teams on the security implications of AI agent capabilities, particularly regarding flags like “–dangerously-skip-permissions” and the use of system utilities.
• Consider sandboxing or isolating AI agent environments to limit their potential impact if they inadvertently trigger malicious-like behaviors or are compromised.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.