AI coding agents trigger endpoint security rules

Sophos examined a week of endpoint data and found that AI coding agents like Claude Code, Cursor, and OpenAI Codex trigger security rules designed to catch human attackers. The agents are not malicious, but their behavior resembles intruder patterns in detection engines.