Attackers have begun running intrusions through AI coding assistants already approved on a victim's device. Their commands then inherit the trust the organisation gave the tool.
Elastic Security Threat Command documents two such intrusions from August in its November 2026 quarterly report, titled threats, etc.
The report draws on confirmed live intrusions and first-party research observed in Elastic security telemetry between April and September 2026. It does not publish a count of customers or endpoints.
Elastic said the report lands in Australia as the Medicare breach and October's PHP flaws have put visibility on the agenda.
Recent Elastic research found 60 per cent of Australian organisations surveyed had knowingly left part of their environment unmonitored. Only 31 per cent had a central view of the AI agents running in theirs.
On a Windows endpoint on 5 August, an operator drove Claude Code through its VS Code extension over remote desktop. The agent staged tooling and reached a suspicious self-hosted GitLab instance through a SOCKS5 proxy tunnel.
Five days later on macOS, the ChatGPT desktop application acted as a shell command proxy. A single command read internal QA infrastructure documents, dumped the login keychain and filtered the output.
Elastic saw similar activity in two other macOS cases. Coding-agent sessions were started with permission-bypass flags, opened a Cloudflare tunnel and installed persistence.
"An agent that holds credentials and can reach the internet is a new attack surface, whether it's misconfigured or abused," said Mike Nichols, general manager, Security, Elastic.
"When an attacker is behind it, its activity looks exactly like the employee who installed it," he said.
In three of the documented threats, the payload was a signed, legitimate product. They were a remote monitoring agent, an AI coding assistant and a Microsoft first-party client.
Eight Minutes to Log In
Infostealers remain a dominant threat. Elastic said the average time from a ClickFix or infostealer infection to the attacker logging in with stolen credentials was eight minutes.
Across 27 confirmed infostealer findings on customer endpoints, the theft ran inside something already trusted. Examples included a signed remote monitoring agent, a browser updater and Apple's own scripting utilities.
ClickFix-style fake verification pages, which walk a victim into pasting a command into the Windows Run dialog, were the dominant entry point. One healthcare finding went from lure to malware delivery in about 16 seconds.
Remote monitoring and management tools were abused in 23 confirmed findings between 15 June and 12 August. ScreenConnect was named most often, delivered from freshly registered domains.
About two-thirds of observed malicious domains were less than 90 days old when used. The report calls domain age one of the cheapest and most effective triage signals available.
Identity attacks continue to bypass multi-factor authentication. Phishing kits such as Tycoon 2FA relay a victim's genuine MFA challenge, and in Elastic's analysis a persistent Entra ID token was issued within minutes.
In one July case, a compromised university account reached Azure Resource Manager through a legacy password-based sign-in flow that conditional access policies never inspected.
On 4 August, Elastic identified CHAINDROP, a worm that used a compromised npm maintainer's credentials to backdoor more than 400 packages. Together they account for 1.3 billion monthly downloads.
Its payload swept for AI tooling credentials from Anthropic, OpenAI, Cursor and Gemini alongside cloud keys. It also planted hooks in Claude Code and VS Code settings, so opening an infected repository could trigger it.
Watch What the Tool Does
The report also reconstructs the July Hugging Face incident, which ran to roughly 17,600 actions including lateral movement across internal clusters within four days. OpenAI stated its own evaluation models drove the activity.
Elastic says defenders face a choice. They can alert on every AI tool action and drown in noise, or trust tools by default and miss real attacks.
"So the question for defenders isn't whether a tool is approved; it's what that tool is actually doing," Nichols said.
The report recommends threat modelling the agent estate before an incident. That means mapping which processes parse untrusted input and what each service account can reach.
AI also helped defenders. Elastic said its bug bounty triage pipeline agreed with human engineers 85 per cent of the time, at about US$2 a report.