Sophos: Claude Code, Cursor and Codex routinely trigger endpoint detection rules written to catch human attackers — DPAPI credential decryption, certutil→bitsadmin fallback, startup-folder writes · Jadid

Skip to content

JadidJust-in AI Developments, Incidents & Deadlines

Friday, July 10, 2026 · 3 of 5

Sophos: Claude Code, Cursor and Codex routinely trigger endpoint detection rules written to catch human attackers — DPAPI credential decryption, certutil→bitsadmin fallback, startup-folder writes
Jul 8Security Production

Read the full briefing · 12 stories