AI coding agents trigger security rules built for attackers

Sophos found that Claude Code, Cursor, and OpenAI Codex triggered endpoint detection rules over a one-week period. The agents' behavior mimics attacker tactics, causing false alarms.