Sophos: Coding Agents Like Claude Code and Codex Trigger Real EDR Threat Alerts

·1 views

A July 2026 Sophos telemetry report found that coding agents including Claude Code, Cursor, and OpenAI Codex triggered endpoint detection and response (EDR) alerts on Windows machines during a seven-day window in June 2026. The agents' routine behavior — such as decrypting browser credentials for automation and downloading dependencies via bitsadmin — matched the same behavioral patterns that EDR rules are designed to flag as attacker tradecraft. Credential Access alerts accounted for 56.2% of blocks, largely driven by agents using the Windows DPAPI to unlock saved browser data, the same mechanism used by real infostealers. Sophos's finding is not that the agents are malicious, but that benign agent activity is now indistinguishable from attacker behavior at the rule level. Security teams operating coding agents on managed endpoints are advised to address these false-positive risks proactively before alerts begin disrupting workflows.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Complete Guide to LLM Fine-Tuning: LoRA, VRAM, Learning Rates and More

A comprehensive guide published on DEV Community outlines the full lifecycle of training large language models, from data preparation and tokenizer selection to deployment monitoring. The guide emphasizes that successful AI model development requires a clear objective, clean and legally usable data, an appropriate architecture, and rigorous evaluation. It explains core concepts such as loss functions, backpropagation, and optimization algorithms like AdamW, which are applicable beyond LLMs to computer vision and speech models. A key focus is helping developers choose the right training approach — such as LoRA for efficient fine-tuning versus costly from-scratch pretraining — based on their specific use case. The guide warns that selecting the wrong method early can waste millions of training examples and significant computational resources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WebAuthn PRF Extension Enables Passwordless End-to-End Encryption in Browser

A developer has built an end-to-end encrypted notes app called pknotes that uses the little-known PRF extension in the WebAuthn specification to derive encryption keys directly from passkey authentication. During a standard passkey login, the browser receives a deterministic 32-byte output from the authenticator that never reaches the server, which is then used via HKDF-SHA256 to derive a key-encryption key in browser memory. This key-encryption key unwraps a randomly generated AES-256 master key, which in turn encrypts the user's notes — meaning the passkey unlocks data in a cryptographic sense, not just an identity sense. The architecture supports multiple devices by having each passkey wrap its own copy of the master key, so adding a new device requires only one additional wrap operation rather than re-encrypting all data. A one-time 160-bit recovery code is issued at signup as a fallback, and full device revocation triggers a fresh master key generation and complete re-encryption of all stored notes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

What an 'Agentic Harness' Actually Is and Why It Matters for AI Agents

The term 'agentic harness' is gaining traction in AI development circles, but its meaning is often misunderstood as simply referring to the IDE or app running an agent. Drawing on Simon Willison's definition, an AI agent is an LLM equipped with tools and running in a loop to achieve a goal. The harness refers to the underlying infrastructure that governs this loop, determining whether the agent continues working or considers its task complete. Crucially, the harness is separate from the user interface, meaning developers can swap front-end interfaces without altering the core agent logic. Some agents, in fact, require no user interface at all, making the harness the invisible but essential layer driving autonomous AI behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Uses a Single Keyword to Detect When AI Loses Track of Instructions

A developer has shared a simple technique to monitor AI consistency during long conversations: instructing the AI to begin every response with a chosen word, in this case 'RES'. If the word is missing from a reply, it signals that the AI may have drifted from earlier instructions, prompting a closer review. The method draws on a concept from cybersecurity called a canary token, which uses a hidden string to detect prompt injection attacks, though the developer's use is focused on catching natural model drift rather than malicious interference. The technique requires no tools or cost — just a single line added to custom instructions or a system prompt. The developer emphasizes it is a supplementary warning sign and does not replace careful human review of AI-generated responses.

0 comments Read more at DEV Community