AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

Sophos researchers discovered that AI coding assistants like Claude Code, Cursor, and OpenAI Codex are triggering traditional endpoint security rules designed to detect malicious activity. These agents, while harmless in themselves, perform actions – such as decrypting browser credentials, listing stored secrets, and writing to startup folders – that resemble attacker behavior, causing security systems to flag them as threats. Sophos emphasizes that this shift is due to AI agents now exhibiting a ‘pivot-when-blocked’ behavior, mimicking attacker tactics and overwhelming traditional detection methods. The solution, according to Sophos, is to refine endpoint rules to specifically target agent-related activity, focusing on parent processes, workspaces, and download reputations, while maintaining strict control over credential access.