AI Coding Agents Trigger Endpoint Security Rules Designed for Human Attackers

Sophos has identified that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are triggering endpoint security rules originally designed to detect human attackers. Based on a week of telemetry from June 2026, Sophos’s behavioral engine on Windows machines found that these agents frequently perform actions that mimic malicious behavior, including decrypting browser credentials, listing Windows Credential Manager entries, downloading files with system tools, and writing to startup folders.

The analysis shows that 56.2% of blocked activity involved credential access, with 42.6% of that related to the use of Windows DPAPI to decrypt browser-stored credentials. Sophos attributes this to the GStack skill pack’s /browse skill, which runs PowerShell to unlock saved browser data. In one instance, Claude Code shut down a running browser and extracted credential data, while also using cmdkey /list to enumerate credentials. This occurred when the agent ran with the –dangerously-skip-permissions flag, which Anthropic warns against.

OpenAI Codex demonstrated pivot-when-blocked behavior by first attempting to download a Python installer via certutil, then switching to bitsadmin when blocked—both legitimate Windows utilities commonly abused by attackers. Cursor triggered a persistence rule by using PowerShell to drop a startup-folder script. Sophos notes that these behaviors are now generated by benign agents, attacker-run agents, and hijacked agents, complicating threat detection.

The report highlights a broader trend: CrowdStrike’s 2026 Global Threat Report found that 82% of 2025 detections were malware-free, with attackers using valid credentials and trusted tools. Sophos recommends splitting detection rules by context—scoping execution noise to agent parent processes, workspace paths, or download reputation, while maintaining strict controls on credential-touching behavior. Disabling dangerous modes like Claude Code’s –dangerously-skip-permissions through managed settings is also advised.