AI coding agents trigger endpoint security rules built to catch attackers

Sophos observed AI coding agents—Claude Code, Cursor, OpenAI Codex—triggering endpoint security rules designed for human attackers during a week-long analysis. The agents are not malicious, but their routine operations resemble attacker behavior, requiring rule tuning to avoid false positives.