Yesterday frontier models shipped. Today security teams are looking at their EDR dashboards and muttering.

Claude Code, Cursor, and OpenAI Codex are setting off endpoint rules written to catch human intruders. Sophos X-Ops published a week of Windows telemetry that makes the problem concrete: the agents are not malware. They just do malware-shaped work as a side effect of helping you code.

If you run agentic tooling on developer laptops, this is your Thursday briefing.

What Sophos actually saw

The Hacker News summary and Sophos’s own write-up pull from seven days of June 2026 telemetry on Windows, counted by unique machines.

Breakdown that matters:

The loudest single rule (42.6% of credential-access hits) fires when a process uses Windows DPAPI to decrypt browser-stored credentials. Sophos watched GStack’s /browse skill do exactly that under Claude Code — PowerShell calling DPAPI so the agent can automate a browser session. Legitimate automation. Identical telemetry to credential theft.

Other highlights from the week:

• Claude Code with --dangerously-skip-permissions (the flag Anthropic tells admins to block) ran scripts that pulled browser credential stores and cmdkey /list against Windows Credential Manager.
• Codex tried to fetch a Python installer from the real python.org via certutil, got blocked, and pivoted to bitsadmin. Same living-off-the-land sequence defenders use as attacker signal.
• Cursor wrote a PowerShell script into the startup folder — classic persistence pattern. Sophos could not confirm intent; the rule still fired correctly.

The uncomfortable point: pivot-when-blocked is what used to separate a live operator from a dumb script. Benign agents now do it too.

Why this is not “just false positives”

CrowdStrike’s 2026 Global Threat Report already said 82% of 2025 detections were malware-free — attackers ride valid credentials and trusted tools. Behavioral EDR is the answer to that world. Coding agents now generate the same behaviors for ordinary reasons, so the high-signal rules get crowded.

Sophos also notes the flip side: attackers already use coding agents to build and test malware against EDR products, and separate research shows agents can be hijacked into running attacker code inside a trusted user session (agentjacking). Same surface, three actors:

1. Benign developer agent
2. Attacker-run agent in a lab
3. Hijacked agent on a real laptop

Raw action telemetry alone no longer tells you which one you are looking at.

Practical defender moves from Sophos (paraphrased):

• Scope noisy execution rules to agent parent processes (claude.exe, cursor.exe, their children), workspace/temp paths, and download reputation.
• Do not blanket-allow credential-access patterns. Treat DPAPI browser decrypts and Credential Manager enumeration as high risk even when the parent is an agent.
• Ban or heavily gate --dangerously-skip-permissions and equivalent god-modes on managed machines.
• Assume agents will retry. Detection that only looks at first-attempt LOLBins will miss the pivot.

If your SOC still treats every agent alert as “dev noise,” you are training yourself to ignore the exact behaviors attackers already copy.

GPT-5.6 day after: numbers for agent builders

OpenAI’s official GPT-5.6 post is live with the evals that were still rumor when Sol/Terra/Luna cleared the government gate yesterday.

What matters if you route coding agents:

• Agents’ Last Exam (long-running professional workflows across 55 fields): Sol hits 53.6, +13.1 over Claude Fable 5 adaptive. Even medium reasoning beats Fable by 11.4 points at roughly one-quarter estimated cost.
• Artificial Analysis Coding Agent Index: Sol max reasoning SOTA at 80 (+2.8 over Fable 5) with under half the output tokens, under half the time, ~one-third lower estimated cost.
• Terminal-Bench 2.1 and DeepSWE: new highs on CLI workflows and long-horizon real-codebase work.
• ultra mode: coordinates multiple agents in parallel (default four) for hard tasks — BrowseComp / SEC-Bench Pro / Terminal-Bench show the multi-agent frontier shifting up and left on score-vs-latency charts.
• Programmatic Tool Calling in the Responses API: the model writes small programs that filter tool results instead of stuffing every intermediate blob back into context. Fewer tokens, fewer round trips.

Cursor, Cognition, Qodo, Notion, and others are already on the record with early evals. The router pattern from yesterday still holds: Terra/Luna for volume loops, Sol (or ultra) for planning and merge judgment. Grok 4.5 remains the cheap parallel worker at 2/6 per million tokens if you are co-located on Cursor/Grok Build.

Government gate is still the understory. Sol shipped after Commerce review. Fable returned with stricter classifiers. Policy latency is part of model risk now — budget for it on the next frontier drop.

Microsoft keeps eating the OpenAI bill

Still relevant 48 hours later: Microsoft is routing tens of thousands of weekly Copilot prompts in Excel and Outlook through in-house MAI models instead of OpenAI/Anthropic (Bloomberg via multiple summaries). Mustafa Suleyman has been public about cutting Anthropic spend. MAI Code is already in GitHub Copilot Business/Enterprise.

For anyone building on M365 surfaces: “Copilot” is a product brand, not a model identity. High-volume Office tasks will keep sliding to MAI; frontier calls stay on third-party for the hard stuff until MAI catches up.

Stack notes for Friday

If you run coding agents on corp laptops:

1. Talk to security this week. Share the Sophos post before the next incident ticket lands on your desk. Propose process-scoped allowlists for execution noise and hard blocks on credential-access god-modes.
2. Log agent parent process + workspace path. When EDR fires, you need that correlation or every alert becomes “was it Claude or an attacker?”
3. Re-price Sol/Terra/Luna today. List prices and ultra multi-agent costs will reshape routers. Do not leave GPT-5.5 as default if Terra undercuts it.
4. Keep Grok 4.5 as the swarm subagent for refactors and test gen; reserve Sol/Fable-class for architecture and PR judgment.
5. Assume Microsoft routing will keep shifting. Do not hard-code “Excel AI = OpenAI” in product docs.

Useful gear if you are still dual-boxing local runners alongside cloud agents: a used NVIDIA A6000 / 6000 Ada for offline harness loops, a USB-C dock that survives three laptop harnesses, and a mechanical keyboard that does not die at 3 a.m. during agent overnight runs. For team seats, Cursor still has the shortest path to Grok 4.5; Claude Code and Codex map cleanly onto Sol once your API org has full access.

The agent stack got more capable this week. The endpoint stack did not get a matching upgrade. That gap is the story.

Affiliate disclosure: Amazon links above use our Associates tag (spaghettistor-20). We only link tools we would actually buy for agent harness work.