AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

Sophos analyzed its endpoint data over a week and discovered that AI coding agents, including certain models from companies like Claude, Cursor, and OpenAI, are triggering security rules designed to detect human attackers. These agents are not malicious, but their actions mimic those of an attack, causing them to be flagged by behavioral engines. The agents' behaviors that raise alarms include decrypting browser credentials and listing contents of Windows' credential store. This occurs because the agents' activities resemble those of human intruders, despite being legitimate. The issue highlights a challenge in distinguishing between legitimate and malicious activity. The AI coding agents' actions are innocuous but are being incorrectly identified as potential threats.