AI Coding Agents Trigger EDR Rules via DPAPI and LOLBAS
Sophos telemetry from June 2026 reveals that AI coding agents including Claude Code, Cursor, and OpenAI Codex are triggering endpoint detection rules designed to catch human attackers, performing …
AML.T0047 - ML-Enabled Product or Service
AML.T0051 - LLM Prompt Injection
AML.T0057 - LLM Data Leakage