AI Coding Agents Are Tripping Security Alarms Built for Hackers

Sophos analyzed seven days of its own security telemetry from Windows systems and discovered that AI coding agents regularly trigger the same behavioral rules designed to catch hackers. Claude Code, Cursor, and OpenAI Codex aren't doing anything malicious, they're simply carrying out routine developer tasks in ways that look identical to an intruder's activity to an attack-detection engine.

Sophos notes that this is a narrow slice of data from one vendor's fleet, not an industry-wide census. The company itself describes its findings as an early signal rather than a final verdict, though it considers the direction of the trend clear.

What Triggered the Alarms

The largest group of alerts, 42.6 percent of all credential-related reports, was triggered by a single rule detecting the use of Windows DPAPI to decrypt browser-saved passwords. Sophos observed this pattern when Claude Code used the popular GStack skills package, whose /browse function runs a PowerShell script that calls on DPAPI.

In another case, Claude Code closed an active browser, extracted its saved login data via a script, and then ran the cmdkey /list command to inspect the contents of Windows Credential Manager. OpenAI Codex, meanwhile, tried to download the Python installer using certutil, and after that path was blocked, switched to bitsadmin, two legitimate but frequently attacker-abused system tools.

Cursor and the Startup Folder

Cursor was caught using PowerShell to write a script into the Windows startup folder, a technique defensive systems flag regardless of intent. Sophos admits it couldn't determine exactly what the script was meant to do, which itself shows how hard it is to tell routine agent automation apart from an attempt to establish persistence on a system.

This is an early signal, not a verdict - Sophos, security telemetry report

Why the Rules Catch Legitimate Work

The problem stems from a broader shift in attack detection. The CrowdStrike 2026 Global Threat Report, cited by Sophos, found that 82 percent of 2025 detections involved no malware at all, since attackers increasingly move using stolen but genuine credentials and trusted system tools instead of dropping malicious files. That's exactly what pushed detection toward analyzing behavior rather than file signatures.

The trouble is that AI agents generate exactly the same behavioral patterns for entirely innocent reasons, flooding the signal security teams rely on. Decrypting a browser password, downloading a file with certutil, or writing to the startup folder have long been treated as highly reliable indicators of attack. What's changed is who's generating them, since on the machines Sophos observed, it's increasingly a developer's AI assistant doing its everyday job.

What Sophos Recommends

The company proposes splitting rules according to what they actually catch. Noise related to command execution should be curbed by tying rules to the agent's parent process, such as claude.exe or cursor.exe, its working directory, or the reputation of the address something is downloaded from. Access to credential stores, however, Sophos says should be treated as a hard boundary to be blocked regardless of whether a human or an agent is behind it.

Sophos also recommends disabling the --dangerously-skip-permissions mode in Claude Code through centralized managed configuration, noting that Anthropic's own documentation warns against using this mode. The open question the report raises is what a coding agent should even have access to on an endpoint in the first place, with credential stores flagged as a sensible place to draw the first line.

What It Means for Development Teams

For companies using Claude Code, Cursor, or Codex, this translates into a concrete task for security teams' configurations: either learn to distinguish agent traffic from attacker traffic, or get flooded with false positives until they start ignoring them, which is exactly the scenario detection systems were meant to avoid. Sophos isn't claiming this is an industry-wide problem, but the fact that three of the most popular AI coding tools trigger highly reliable alerts during normal work is itself a signal that access policies and EDR configurations written for humans need to be revisited for agents.