{"schema_version":"0.10.0","id":"LR-2026-0618","record_version":1,"title":"AI coding agents trigger endpoint security rules (Sophos, June 2026 telemetry)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"7bc0e8327020ee0f85974af9d16008e11457d00a61e4224058fb6a18ae677a7a"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-06-01","date_occurred_precision":"month","date_disclosed":"2026-07-08","incident_class":"other","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Sophos reviewed a week of June 2026 endpoint telemetry and found that AI coding agents, including Claude Code, Cursor and OpenAI Codex, were setting off detection rules built to catch human intruders. The agents were doing ordinary developer work: a GStack browser skill called DPAPI to decrypt saved browser data, Claude Code ran cmdkey /list, Codex fetched a Python installer with certutil and switched to bitsadmin after a block, and Cursor wrote a startup-folder script. The source states the agents are not malicious. The source says the rule on browser credential decryption is right to fire, because the detection engine cannot tell the activity from theft. Sophos called its reading an early verdict and noted the shift is still small. Sophos could not confirm what the startup script did.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/07/ai-coding-agents-found-triggering.html","publisher":"The Hacker News","date":"2026-07-08","type":"press","title":"AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.date_occurred":"C","event.agent_involved":"C","event.incident_class":"D","impact.severity":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":0,"quote":"The analysis draws on seven days of telemetry from June 2026, taken from Sophos's behavioral engine on Windows and counted by unique machines, not raw event volume."}],"event.agent_involved":[{"source_index":0,"quote":"Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch human intruders."}],"event.incident_class":[{"source_index":0,"quote":"Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch human intruders."}],"impact.severity":[{"source_index":0,"quote":"The agents are not malicious."}],"event.summary":[{"source_index":0,"quote":"Sophos looked at a week of its own endpoint data and found that AI coding agents such as Claude Code, Cursor, and OpenAI Codex are setting off detection rules written to catch human intruders."},{"source_index":0,"quote":"The agents are not malicious."},{"source_index":0,"quote":"Its /browse skill does exactly that, running PowerShell that calls DPAPI to unlock saved browser data."},{"source_index":0,"quote":"Separately, it ran cmdkey /list to enumerate the credentials Windows Credential Manager was holding."},{"source_index":0,"quote":"OpenAI Codex did just that, fetching a Python installer from the real python.org, starting with certutil."},{"source_index":0,"quote":"That was blocked, so it switched to bitsadmin."},{"source_index":0,"quote":"Cursor tripped a persistence rule by using PowerShell to drop a startup-folder script that would run every time the machine booted."},{"source_index":0,"quote":"To the detection engine, it is credential theft, and the rule is right to fire."},{"source_index":0,"quote":"Sophos calls this an early read, not a verdict, and notes the shift is still small even if the direction is clear."},{"source_index":0,"quote":"Sophos could not confirm what the script did, but writing to startup outside a trusted installer is the kind of thing defenders flag on sight."}]},"notes_on_gaps":"Single press source (The Hacker News) reporting a Sophos early read; no Sophos primary report or agent vendor statement was provided. The body does not state a disclosure date, so date_disclosed is left out; the source header date 2026-07-08 was not used as a value. The telemetry window is stated only as June 2026, so date_occurred is recorded as YYYY-MM. No harm is reported; the source calls the target harmless and the outcome of Cursor's startup script is unconfirmed. Judgements made: incident_class set to other because no closed class fits benign agent activity tripping rules; near_miss set true because activity was blocked or flagged without reported harm; severity set negligible as no effect beyond the systems is stated; control F2 treated as held because endpoint rules fired on the activity; B1 treated as got_around because the skip-permissions flag was set. Root cause, responsible party, trigger, and failure class are left out because the sources do not state them for this event. System model, version, developer and harness are left out because the agents named are several products and the source does not tie one to a single system. Risk RK03 is cited from Sophos's advice, not a reported loss of credentials. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"analysis":{"sections":{"timeline":[{"text":"Seven days of June 2026 endpoint telemetry from Sophos's behavioral engine on Windows are analysed.","quote":"The analysis draws on seven days of telemetry from June 2026, taken from Sophos's behavioral engine on Windows and counted by unique machines, not raw event volume.","source_index":0,"when":"2026-06"},{"text":"Claude Code shut down the running browser and ran a script that pulled data from its credential store.","quote":"In one instance, Claude Code shut down the running browser and ran a script that pulled data from its credential store.","source_index":0,"when":null},{"text":"Cursor used PowerShell to drop a startup-folder script that would run every time the machine booted.","quote":"Cursor tripped a persistence rule by using PowerShell to drop a startup-folder script that would run every time the machine booted.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/07/ai-coding-agents-found-triggering.html"]}}