AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
Sophos says Claude Code, Cursor, and Codex triggered Windows endpoint rules for credential access, LOLBin downloads, and persistence.
More info