AI Coding Agents Trigger Credential-Theft and LOLBin Detections on Endpoints

Security researchers reported that AI coding agents are increasingly setting off endpoint detections because their routine actions resemble attacker tradecraft on both macOS and Windows systems. Hunt & Hackett described a macOS investigation in which a shell process ran

security dump-keychain -a

and filtered the results for a Bitbucket API token, initially appearing to be credential theft before investigators tied the activity to a legitimate developer using an AI-assisted coding environment. Sophos separately observed Windows telemetry showing agents such as Claude Code, Cursor, OpenAI Codex, and tools built on GStack triggering detections associated with Credential Access and Execution, including DPAPI-based browser credential decryption, Python access to browser credential stores, and cmdkey.exe enumeration of Windows Credential Manager entries.

The reported activity also included repeated LOLBin-based download attempts using trusted utilities and at least one blocked startup-folder persistence attempt linked to Cursor, underscoring how benign agent behavior can overlap with high-confidence intrusion signals. Researchers said the observed cases were not malicious, but warned that autonomous agents, weak logging of intent, prompt-injection risk, and permissive settings such as Claude Code's dangerous no-approval mode can turn similar workflows into genuine incidents. They recommended treating AI agents as a new execution layer with least privilege, isolation, stronger approvals for sensitive actions, and continued strict monitoring of credential-store access rather than broadly suppressing detections.