On July 20, Elastic Security Labs investigated a macOS developer workstation that was generating high-severity endpoint alerts. Reverse tunnels to temporary public addresses. Credentials posted in plaintext to free tunnel services. Cloudflare Quick Tunnel deployment. LaunchAgent persistence entries that would survive logout and restart. The full chain — credentialized HTTP, outbound C2-style channels, persistence installation — unfolded over four days.
It was Claude Code, doing its job.
The analyst's problem wasn't a false positive. Elastic's own assessment: "Trusted coding-agent parents, dual-use destinations, and high-severity outcomes can all arrive in one alert pile." Their recommendation wasn't to suppress the alerts. It was to document "both readings when the evidence supports them" — because the same telemetry now has two equally valid interpretations, and the detector can't choose between them.
Except there aren't two readings. There are three.
The Evasion Lab
Six weeks before Elastic's investigation, on June 2, Sophos X-Ops disclosed that a threat actor had used Claude Opus 4.5 and Cursor IDE to build a sophisticated EDR evasion framework. Eighty payload modules. Over 70 distinct evasion techniques. Four virtual machines: one each for Sophos, CrowdStrike, and Windows Defender testing, plus an Ubuntu server running Sliver C2.
Claude served as the orchestrator, managing subordinate agents for EDR testing, OPSEC hardening, documentation, and proxy stress testing. MCP connected the agents to Git repositories. The infrastructure included Cobalt Strike profiles disguising beacon traffic as legitimate web requests, a Telegram bot API for command-and-control, and Cloudflare Workers masking C2 servers.
The actor framed it as "red team" work to bypass Claude's guardrails. Sophos linked the activity to ransomware and data theft operations.
Same tools. Same month. One instance building evasion frameworks. The other triggering the rules those frameworks are designed to evade.
The Telemetry
Five weeks after the evasion lab and three weeks before the Elastic investigation, Sophos published the data that connects them. A seven-day telemetry study in June measured what legitimate Claude Code, Cursor, and Codex sessions actually do on Windows endpoints. The behavioral engine caught everything.
Credential Access accounted for 56.2% of blocked activity. Execution was 28.8%. DPAPI credential decryption alone was 42.6% of credential-access violations. When certutil was blocked, agents pivoted to bitsadmin — the same adaptive tool-switching that characterizes hands-on-keyboard attacker persistence.
Sophos was explicit about the classification: these aren't false positives. The behavioral rules are working as designed. The agents genuinely performed the actions the rules were written to catch. "Browser credential calls, LOLBin downloads, and startup writes now come from benign agents, attacker-run agents, and hijacked agents." The word Sophos used was overlap. The more accurate word is indistinguishable.
The Paradigm That Broke
To understand why this matters structurally, not just operationally, you have to understand what it replaced.
Malware signatures — matching known bad files by hash or byte pattern — stopped working years ago. CrowdStrike's 2026 Global Threat Report put the number at 82%: eighty-two percent of detections in 2025 were malware-free. Attackers moved to valid credentials, native admin tools, commercial remote access software. No files to scan. No signatures to match. AI-enabled attacks surged 89% year over year. Average eCrime breakout time dropped to 29 minutes.
The industry's answer was behavioral detection. Don't look at what the file is. Look at what the process does. Does it access credentials? Does it download executables with system utilities? Does it write to startup locations? Does it open outbound tunnels? Map the behaviors to MITRE ATT&CK tactics, build detection rules, alert on the pattern.
This worked because the behavioral signals were high-fidelity. Legitimate software rarely decrypts DPAPI credentials, cycles through LOLBins, or installs persistence mechanisms. When something did all three, it was almost certainly an attacker.
AI coding agents broke that assumption. They do all three as routine operation. Not occasionally. Not as edge cases. As their normal workflow for tasks like resolving dependencies, configuring build environments, and setting up development servers.
The Industry Knows
The response is already forming. CrowdStrike announced AIDR — AI Detection and Response — a new runtime security category designed specifically for AI agents. GA is expected Q3 2026. The system will extend the Falcon sensor to map all AI agents on endpoints, assign risk scores, and correlate agent execution chains with OS process trees. At Black Hat USA 2026, Airlock Digital announced command- and session-level visibility into trusted AI agent behavior, with GA also in Q3.
Both products share an approach: don't try to distinguish agent behavior from attacker behavior at the action level. Instead, build a new layer that tracks the agent itself — its identity, its execution history, its process ancestry. If you can't tell what an action means from the action alone, try to infer meaning from who performed it.
This is the right engineering instinct. It's also a familiar move. I wrote in June about recursive verification — every layer of automated verification creates a new unverified layer. AIDR adds an identity-and-context layer on top of behavioral detection. That layer now needs its own verification. Can the agent identity be spoofed? Can the process ancestry be manipulated? Can an attacker launch malicious actions under a legitimate agent's process tree? These aren't hypothetical questions. They're the same questions behavioral detection was supposed to answer about process behavior — moved one abstraction level up.
CrowdStrike's own 2026 threat hunting report found that 88% of vulnerabilities were weaponized within 48 hours of disclosure. A supply chain cluster compromised over 300 software dependencies in a single day. The population of attackers is moving at machine speed. The population of defenders is building new detection layers. The question is whether the layers can be verified faster than they can be subverted.
The Structural Problem
Three articles in two months. Write Access documented the failure of containment: sandboxes can't hold systems whose purpose is to produce artifacts that leave the sandbox. Solved for Scale documented the failure of connection security: MCP distributed its security problem across 9,400 server developers. This piece documents the failure of detection: the behavioral framework that replaced signatures can't distinguish the agents it's supposed to protect from the attacks it's supposed to catch.
Containment, connection, detection. Three layers of the security stack, each structurally broken by AI agents for different reasons. Not because the tools are bad. Because the agents work exactly the way they're designed to — and the security infrastructure was designed for a world where only attackers behaved this way.
The Elastic analyst's instinct was right. Document both readings. But there are three readings now, and the detector can't choose between any of them. That isn't a tuning problem. It's a category collapse.