That is not a hypothetical. It is what Sophos found when it spent seven days watching its own endpoint telemetry in June 2026.
AI coding agents, such as Claude Code, Cursor, and OpenAI Codex, were triggering detection rules designed to catch human attackers. Not because they were doing anything malicious. But because the things they do as a matter of routine look, to a behavioural engine, exactly like an intrusion in progress.
Decrypting browser credentials. Listing what sits in Windows’ credential store. Pulling files down using built-in system tools. Writing to startup folders. These have been high-signal attacker behaviours for years. Security tools are trained to fire on them. The problem is that AI coding agents do all of them too, just as part of ordinary development work.
What the Telemetry Actually Shows
Sophos pulled a week of data from its CIXA behavioural engine on Windows and categorised the blocking events by MITRE ATT&CK tactic. Credential Access accounted for 56.2% of blocked activity. Execution came in at 28.8%. The single biggest trigger, at 42.6% of all credential access events, was a rule that fires when a process uses Windows’ built-in Data Protection API to decrypt stored browser credential data. That is a classic attacker technique. It is also exactly what GStack’s browse skill does when an AI agent needs to automate a browser task.
Cursor triggered a persistence rule by writing a VBScript file to the Windows Startup folder via PowerShell. Again, not malicious in context. But writing to startup folders outside a trusted installer is inherently suspicious behaviour, and security tools treating it as such are doing their job correctly.
That last point matters. Sophos was clear: the rules are not broken. They are working as designed. The challenge is that the landscape they were designed for has changed.
Why This Is a Harder Problem Than It Looks
The instinct when reading this is to think the fix is simple. Whitelist the AI tools, tune the rules, move on.
It is not that straightforward. A month before publishing this research, Sophos documented a separate case where a threat actor used AI agents to build and test malware specifically designed to evade EDR products. There are also documented cases of coding agents being hijacked through poisoned inputs, where the agent acts inside a trusted user session and executes attacker code while appearing benign.
So the same surface- browser credential calls, PowerShell execution, startup writes- now generates signals from three distinct sources: legitimate AI agents doing normal work, attacker-controlled agents building offensive tooling, and hijacked agents acting on behalf of an intruder while appearing as the user.
<cite index=”33-1″>The raw action tells you less than it once did.</cite> That is the core problem. Behavioural detection worked well when the population of things that looked like attacks was mostly attacks. That assumption no longer holds.
What This Means for African Organisations Adopting AI Dev Tools
AI coding assistants are moving fast into South African development teams. Whether you are running an internal tech function, a software development shop, or a managed services environment, the pressure to adopt these tools is real and growing.
The security question that needs to sit alongside that adoption is not just “are these tools safe?” It is “do our security controls know how to handle them?”
If your endpoint detection platform is not aware of which AI agents are running in your environment, you are either generating noise that drowns out real alerts, suppressing alerts that should be firing, or both. Neither is a good place to be.
Practical Starting Points
This does not require throwing out your security stack. It requires applying some deliberate thinking:
- Define a policy for which AI coding agents are approved for use in your environment, and on which systems
- Work with your security team or provider to identify which detection rules are most likely to be triggered by those agents
- Distinguish between rules that should be tuned for known-good agent behaviour and rules that should keep firing regardless of who initiated the action, because some of what AI agents do is risky whether a human or an agent did it
- Maintain visibility into agent activity at the endpoint level, not just at the network perimeter
The speed of AI adoption in development environments is outpacing the security frameworks built to monitor those environments. That gap does not close on its own.
