AI agents are learning to use LOLBins: how to tell automation from an attack now

Sophos X-Ops analyzed behavioral-rule detections associated with Claude Code, Cursor, Codex, and other AI agents. The study covers seven days in June 2026.

Among the detections that caused the system to block activity, 56.2% involved the MITRE ATT&CK tactic "Credential Access," while another 28.8% involved "Execution."

These figures reflect very specific actions. The researchers observed agents:

▪ decrypting browser data through DPAPI;

▪accessing browser credential stores;

▪listing entries saved in Windows Credential Manager with the cmdkey.exe /list;

▪terminating browser processes before reading their data;

▪creating a VBScript script in the Windows startup folder;

▪ launching PowerShell with a parameter that bypasses the execution policy.

The most telling case involved Codex installing Python. First, the agent attempted to download the installer using certutil. After it was blocked, it modified the command parameters and then switched to bitsadmin.

This produced a sequence typical of an attacker's actions:

The task itself was legitimate, however, and the file was downloaded from the official Python website. Previously, this kind of adaptive behavior could be considered a strong indicator of malicious activity. Now, legitimate AI agents can produce the same sequences.