Loading story…
Security researchers reported that AI coding agents are increasingly setting off endpoint detections because their routine actions resemble attacker tradecraft on both macOS and Windows systems. Hunt & Hackett described a macOS investigation in which a shell process ran
security dump-keychain -a
and filtered the results for a Bitbucket API token, initially appearing to be credential theft before investigators tied the activity to a legitimate developer using an AI-assisted coding environment. Sophos separately observed Windows telemetry showing agents such as Claude Code, Cursor, OpenAI Codex, and tools built on GStack triggering detections associated with Credential Access and Execution, including DPAPI-based browser credential decryption, Python access to browser credential stores, and cmdkey.exe enumeration of Windows Credential Manager entries.
The reported activity also included repeated LOLBin-based download attempts using trusted utilities and at least one blocked startup-folder persistence attempt linked to Cursor, underscoring how benign agent behavior can overlap with high-confidence intrusion signals. Researchers said the observed cases were not malicious, but warned that autonomous agents, weak logging of intent, prompt-injection risk, and permissive settings such as Claude Code's dangerous no-approval mode can turn similar workflows into genuine incidents. They recommended treating AI agents as a new execution layer with least privilege, isolation, stronger approvals for sensitive actions, and continued strict monitoring of credential-store access rather than broadly suppressing detections.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Over a seven-day period in June 2026, Sophos analyzed Windows telemetry and found AI coding agents such as Claude Code, Cursor, OpenAI Codex, and GStack-based tools repeatedly triggering behavioral detections. Observed activity included DPAPI-based browser credential decryption, Credential Manager enumeration, LOLBin download attempts, and a blocked startup-folder persistence attempt.
A security investigation examined endpoint detections triggered by a shell process running `security dump-keychain -a` and filtering for a Bitbucket API token on macOS. Investigators determined the activity was a benign true positive tied to a legitimate user's AI-assisted development workflow rather than credential theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcesophos.com
Open sourcehuntandhackett.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which **Claude Code** appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed **LaunchAgent** persistence. Telemetry showed `zsh` processes authenticating to ephemeral `localhost[.]run`, `lhr[.]life`, and `trycloudflare[.]com` URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery. The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from `zsh`, and related coding-agent-parented variants involving **macOS Keychain** access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as **high-severity** signals even when the tooling involved is legitimate and the use case may be dual-purpose.
Aug 10, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026
Multiple reports describe **social-engineering and supply-chain style attacks** that trick developers or AI-agent users into executing attacker-controlled instructions. North Korean operators have been linked to the **“Contagious Interview”** campaign, in which fake recruiter personas lure software developers into running “technical interview” projects that deploy malware such as **BeaverTail** and **OtterCookie** for credential theft and remote access; GitLab reported banning **131 related accounts** in 2025, with many repos using **hidden loaders** that fetched payloads from third-party services (e.g., *Vercel*) rather than hosting malware directly. Separately, OpenGuardrails reported a campaign on *ClawHub* (an OpenClaw AI agent “skills” repository) where attackers posted **malicious troubleshooting comments** containing Base64-encoded commands that download a loader from `91[.]92[.]242[.]30`, remove macOS quarantine attributes, and install **Atomic macOS (AMOS) infostealer**—a delivery method that can evade package-focused scanning because the payload is in comments, not the skill artifact. Research and incident writeups also highlight how **indirect prompt injection** and **malicious open-source packages** can compromise developer environments. NSFOCUS summarized a GitHub **MCP cross-repository data leak** scenario where attacker-injected instructions in public Issues could cause locally running AI agents to exfiltrate private repo data when agents act with broad GitHub permissions, and cited a similar hidden-command issue affecting an AI browser’s page summarization workflow. JFrog reported malicious npm packages (e.g., `eslint-verify-plugin`, `duer-js`) delivering multi-stage payloads including a **macOS RAT** (Mythic/Apfell) and a Windows infostealer, reinforcing ongoing risk from poisoned dependencies. In contrast, a DFIR case study on **CVE-2023-46604** exploitation of Apache ActiveMQ leading to **LockBit**-style ransomware, and a Medium post on recon/content-discovery techniques, are separate topics and not part of the AI-agent/developer social-engineering thread.
Jun 29, 2026