[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTrpfg_M8jeg48Da1s-phNp-HBH7IDSAsrxgVcv0wbf0":3},{"article":4,"iocs":48,"watch_terms":55,"solutions":56,"lesson":118},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"232fd974-f192-4a32-a09c-faf69d9c75c0","AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers","ai-coding-agents-found-triggering-endpoint-security-rules-built-to-catch-attacke-7bc0e8","Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch human intruders. The agents are not malicious. They just do a lot of things that, to a behavioral engine, look exactly like an attack. Decrypting browser credentials, listing what sits in Windows' credential store,","Sophos observed AI coding agents like Claude Code, Cursor, and OpenAI Codex triggering endpoint security rules due to their behavior, which mimics attacker actions such as decrypting browser credentials and downloading files. While these agents are not malicious, their legitimate operations, like using DPAPI to access stored browser data or employing 'living off the land' utilities, are indistinguishable from malicious activity to behavioral detection engines. This phenomenon presents a challenge for defenders, as the same actions can now originate from benign AI assistants, attacker-controlled AI agents, or hijacked AI sessions.","AI coding agents are triggering endpoint security rules designed to catch attackers.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fai-coding-agents-found-triggering.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiEtVOCcf8-6_z0F4FVoPlTMQRFJ4CfHCbl-GvhT9EbRrfZgTJsNbBkzAq72212RbMT1Knk5GJsYDY8p5W7YO8x29vQ782QW6CRorl_oKVyAgOmS46Y9HyTPcdZOmMjOPtWjpAHH3C91EPVk4dnHqaAEX8QoaSvGzCbjMy0YhF7lJaIR6-T9Dq5jzZycIc\u002Fs1600\u002Falarm.jpg","2026-07-08T17:02:12+00:00","2026-07-08T18:00:25.418393+00:00",7,[17,20,22,24,27,30],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":19},"Cursor",{"name":23,"type":19},"OpenAI Codex",{"name":25,"type":26},"Sophos","vendor",{"name":28,"type":29},"DPAPI","technology",{"name":31,"type":29},"PowerShell","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[49,53],{"type":50,"value":51,"context":52},"malware","certutil","Legitimate Windows utility routinely abused by attackers to pull payloads.",{"type":50,"value":54,"context":52},"bitsadmin",[25,18,21],{"controls":57,"vendors":112},[58,87],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":47,"name":88,"problem":89,"products":90},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":108,"product_name":109,"url":110,"description":111},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[113],{"slug":114,"name":25,"logo_path":115,"roles":116},"sophos","\u002Fvendor-logos\u002Fsophos.png",[117],"reported_by",{"slug":119,"title":120,"body":121,"framework_refs":122,"framework_notes":133},"ai-coding-agents-blur-the-line-between-legitimate-tools-and-attacker-behavior","AI Coding Agents Blur the Line Between Legitimate Tools and Attacker Behavior","AI coding agents such as Claude Code, Cursor, and OpenAI Codex perform legitimate development tasks that are behaviorally indistinguishable from attacker techniques — including accessing browser credential stores via DPAPI and leveraging 'living off the land' binaries. Endpoint detection engines built around behavioral heuristics cannot differentiate between a trusted AI assistant and a malicious actor performing the same actions, creating dangerous blind spots. This matters because defenders risk either generating overwhelming false positives that cause alert fatigue, or worse, tuning out detections that would otherwise catch real attackers. As AI agents become embedded in development workflows, organizations must rethink how identity, context, and intent are factored into detection logic — not just raw behavior.",[123,124,125,126,127,128,129,130,131,132],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 8: Audit Log Management","CIS Control 10: Malware Defenses","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-2: Event Logging","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-6: Least Privilege","NIST AI RMF: GOVERN 1.1 – Policies for AI risk management","MITRE ATT&CK T1555.003: Credentials from Web Browsers","MITRE ATT&CK T1218: System Binary Proxy Execution (Living off the Land)",{}]