Sophos report: coding agents trigger EDR detection rules designed for attackers

Short summary

Sophos's July 2026 telemetry report reveals that coding agents like Claude Code, Cursor, and OpenAI Codex routinely trigger EDR detection rules designed to catch attackers, because benign agent behaviors mirror attacker tradecraft at the behavioral layer. Credential access via DPAPI, LOLBin downloads, and PowerShell obfuscation patterns all fired on legitimate agent activity. Organizations deploying coding agents on managed endpoints need to pre-plan EDR rule exceptions and permission policies before SOC alert fatigue sets in.

• •Coding agents trigger EDR rules built for attacker detection, Sophos report finds
• •56% of blocks were credential-access rules triggered by browser automation and DPAPI calls
• •Agents running with --dangerously-skip-permissions amplify the problem with no human in the loop

Generated with AI, which can make mistakes.