That is not a hypothetical. It is what Sophos found when it spent seven days watching its own endpoint telemetry in June 2026. AI coding agents, such as Claude Code, Cursor, and OpenAI Codex, were triggering detection rules designed to catch human attackers. Not because they were doing anything malicious. But because the things they […]
