AI Coding Agents Triggering EDR: False Positives or Automation Gone Rogue?
Hey everyone,
I just came across the Sophos research regarding AI coding agents—specifically Cursor, Claude Code, and OpenAI Codex—triggering endpoint detection rules meant for human intruders. It turns out that when these agents attempt to debug or configure environments, they perform actions that are indistinguishable from post-exploitation tradecraft to a behavioral engine.
The report notes that these agents are frequently accessing the Windows Credential Store and attempting to decrypt browser credentials to assist with authentication flows. To a standard EDR, running a command like this looks like active credential dumping:
cmdkey /list
or accessing the DPAPI directly. I've already seen a spike in "Credential Access" alerts in our environment linked to these tools.
I had to draft a quick KQL query to filter out the noise from legitimate agent processes vs. actual threats:
DeviceProcessEvents
| where FolderPath endswith "\\cmdkey.exe"
| where InitiatingProcessFileName has_any ("Cursor", "Claude", "code")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine
It raises a big question about tuning: Do we risk creating blind spots by whitelisting these processes, or do we accept the alert fatigue? How is everyone else handling the surge in automated tool traffic?
We hit this wall last month when our dev team adopted Cursor. The SOC was drowning in alerts for LSASS memory reads and credential store access. We ended up creating a specific detection rule group that looks for the parent process chain. If the aggressive behavior is spawned by a signed AI agent binary and the user context is a verified developer, we downgrade the severity to Info. It’s not perfect, but it saved our sanity.
From a pentester's perspective, this is hilarious but expected. We've been automating recon with scripts for years; AI just makes it accessible to everyone. The risk is that if attackers figure out how to masquerade as these AI agents—spoofing the parent process name or utilizing signed binaries—we're effectively training our SOC to ignore the exact TTPs the bad guys use. Be very careful with broad whitelisting.
I'm seeing this too. It's basically the 'Shadow IT' problem all over again but with local execution. I've mandated that any AI coding agents must run within a hardened, non-privileged container or a dedicated VM with strict egress rules. If they need to touch the credential store, they should be doing it via a secured API proxy, not by scraping the OS directly. It adds friction, but it keeps the logs clean.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access