Latest
ResearchAn Open Letter to Dario AmodeiResearchAnnouncing State of Enterprise Agent Permissions 2026ResearchClaude Code Security Benchmark: What It Can Access on a Typical Developer LaptopReportState of Enterprise Agent Permissions 2026Research10 Actions Your EDR May Allow an AI Coding Agent to PerformResearchCISO Guide to Agent Least PrivilegeResearchAI Agent Exposure Assessment ChecklistResearchClaude Code vs Human Permissions: What Should Be Different?
Back to Blog
10 Actions Your EDR May Allow an AI Coding Agent to Perform

10 Actions Your EDR May Allow an AI Coding Agent to Perform

EDR asks “is this malicious?” Coding agents require “is this action allowed for this actor?” Ten high-impact actions that often pass threat detection unchanged.

The 1stProtect Team Sep 12, 2026 8 min read

10 Actions Your EDR May Allow an AI Coding Agent to Perform

CrowdStrike, Microsoft Defender, and other EDR/XDR platforms are essential — they are optimized for threat detection and response. Autonomous coding agents introduce a different question: authorization for legitimate software performing unintended actions.

Below are ten actions commonly allowed in enterprise environments because the process is trusted, the user is trusted, or the behavior matches developer activity — even when the autonomous actor should not perform them.

The list

  1. Read ~/.ssh/id_ed25519 — Trusted IDE or terminal child process; no malware signature.
  2. Export AWS credentials from ~/.aws/credentials — Same user context as daily work.
  3. Run curl to an unknown external host with repo context in headers — Looks like debugging.
  4. Invoke MCP tool that wraps local shell — Parent process chain appears normal.
  5. Bulk read .env and secrets.yaml across monorepo — File access under developer ACLs.
  6. Run kubectl delete against a production namespace — Authorized kubeconfig on laptop.
  7. Clone an internal repo to /tmp and archive — Git operations are baseline dev activity.
  8. Modify CI configuration to add exfiltration step — Commit looks like automation improvement.
  9. Disable local security agent (attempt) — May alert eventually; agent retry loops differ from ransomware TTPs.
  10. Spawn subprocess with inherited environment — Full env includes tokens the agent did not need for the task.

Why EDR is not the wrong tool — it is the wrong question

Control planeQuestion
EDR / XDRIs this process or behavior malicious?
AI agent controlIs this action allowed for this autonomous actor on this resource now?

Both belong in the program. Conflating them leaves a gap exactly where coding agents operate: fast, legitimate, over-privileged actions.

What security teams do instead

  • Keep EDR for threat workflows.
  • Add execution enforcement at action time: ALLOW / BLOCK / AUDIT with human vs agent attribution.
  • Start with Audit Mode to see which of the ten show up in ordinary sprint work.

Compare control models: /comparison. Measure exposure: /offers/ai-agent-exposure-assessment.