Sophos pulled a week of endpoint telemetry and found coding agents tripping the rules built to catch intruders. Fifty-six percent of the blocked activity was credential access — agents decrypting the browser's saved passwords, dumping the Windows credential vault, terminating browser processes to read their stores. Nothing about the agents is malicious. They reach those stores because they run on your machine, as you, with everything you can touch.

A developer opens Claude Code, asks it to look something up, and walks to get coffee. On the way back, the endpoint agent flags the session: a process just used a Windows system API to decrypt the browser's stored credential blob. That is a textbook infostealer move. It is also, this time, the coding agent doing exactly what it was asked — reading a page that lived behind a login, the practical way, by unlocking the password the browser had already saved.

Sophos X-Ops spent a week in June 2026 counting these collisions. They took blocking and silent rule hits from their behavioral engine on Windows endpoints, counted by unique machine, and sorted them by MITRE ATT&CK tactic. The picture is blunt. Among blocking rules, credential access was 56.2% of what fired and execution was 28.8%. The single biggest credential rule — 42.6% of that group — fires on a process using the Windows Data Protection API, or DPAPI, the OS service that unlocks secrets a program stored earlier. That is the call an infostealer makes to turn the browser's encrypted password file back into plaintext. It is now also the call a coding agent makes when a skill wants a logged-in page.

Attacker behavior, benign intent, same telemetry

Every step in the chain Sophos caught is a tool a developer would recognize. A "skill pack" — a bundle of ready-made abilities you install into an agent — called GStack ships a /browse skill. When the agent uses it, the process tree runs bash → browse.exe → node → PowerShell, and the PowerShell loads System.Security and calls DPAPI's Unprotect on the browser's saved data. Sophos caught that chain running under Claude Code. Elsewhere in the week: cmdkey /list to enumerate the Windows Credential Manager, taskkill against browser processes by PID so their credential files were free to read, certutil and bitsadmin — two signed Windows utilities — fetching a Python installer, and PowerShell writing a script into the Startup folder so it would run at next login.

Read that list without the words "coding agent" and it is an intrusion. Credential dumping, living-off-the-land binaries — the signed OS tools attackers borrow so nothing unfamiliar shows up — and a persistence foothold. The behavioral engine was right to fire on all of it. Sophos is careful about the conclusion: this is "a first-pass, short signal dump," not a census, and the detections do not mean the agents are malicious. What they mean is narrower and more durable. Some of these actions are risky whoever starts them, and, in their words, "the fact that an AI agent did them does not make them safe."

One week of Windows endpoint telemetry, by MITRE tactic among blocking rules. Credential access dominates: agents decrypting the browser's saved passwords via DPAPI, dumping the Windows credential vault with cmdkey, and killing browser processes to read their stores. The rules were built to catch intruders; they fired on coding agents doing legitimate work with the same reach an intruder would have.

The reach, not the intent, is the problem

The reason the same rule catches a thief and an assistant is that, on a normal setup, they stand in the same place. The agent runs as your user account, on your machine. That account can open the browser's saved passwords because you saved them. It can read the Windows Credential Manager because that vault is yours. It can write to the Startup folder and call certutil because every program you run can. The agent inherits your whole ambient authority — every secret, every signed tool, every writable corner of the disk — the moment it starts. A prompt injection, a poisoned skill, or an over-eager legitimate task then has all of it to work with.

That is why Sophos frames the hard part as policy, not detection: "What should an agent be permitted to do on an endpoint? What boundaries should be enforced?" Their tuning advice splits the rules in two. Some should be taught the agent's known-good signatures so they stop crying wolf. Others "should keep firing, because the activity they catch is risky whether a human or an agent initiated it" — DPAPI decryption and credential-vault dumps among them. And that leaves a defender with a real bind. Suppress the credential rule to quiet the agent, and you go blind to the infostealer that makes the identical call. Keep it firing, and your queue fills with a tool your own developers installed. Neither choice is good, because both assume the agent has to live on the endpoint next to the secrets.

Move the agent, and the vault isn't there to open

The bind only holds while the agent lives next to the secrets. Bromure Agentic Coding runs each coding agent inside a disposable Linux VM, one hypervisor away from your Mac. The agent's world is that VM. Your macOS Keychain is not in it. The browser profile where you saved your passwords is not in it. There is no Windows Credential Manager, no host Startup folder, no host browser process to kill and rifle. When a skill reaches for the saved-password store the way GStack's /browse does, the reach lands inside a fresh VM that never held those passwords. The call can run; it finds nothing worth taking.

That leaves the credentials the agent needs to do the work — the API key for the model, a GitHub token to push a branch, an AWS secret to deploy. Handing those to the VM would just recreate the vault you moved away from. Bromure does not hand them over. A man-in-the-middle proxy on the host sits on the wire between the VM and the outside world. Inside the VM the agent holds only fakes — a placeholder brm_… string where the real key should be. When the agent makes a request to api.anthropic.com or github.com, the proxy swaps the fake for the real value on the way out and swaps it back on the way in. The genuine secret is present for the one hop that needs it and never enters the VM's memory. An agent that decrypts everything it can find in its own environment comes away with placeholders.

Left: the agent runs on the host as you, inside your ambient authority — the browser password store, the OS credential vault, the Startup folder, the signed download tools. A legitimate reach and an infostealer's reach are the same call, so the endpoint rule fires either way. Right: Bromure runs the agent in a disposable VM. The host's stores are not present, and the credentials the agent does use are fakes that the host proxy swaps to real only on the wire. The attacker-shaped call still runs; it lands somewhere with nothing to take.

Two rules that keep the human in the loop

Isolation moves the secrets out of reach; two more controls decide when a real one is allowed to leave the host at all. Every credential swap can be set to require approval — the fake-to-real substitution pauses and a dialog on your Mac asks before the real value goes out. For an SSH key or an AWS request you grant it for five minutes, an hour, or the rest of the session, then it locks again. And for databases wired in through the proxy — MongoDB, ClickHouse, Elasticsearch — a guardrail reads the actual operation on the wire and can block the destructive ones, so a DELETE the agent talked itself into never reaches the real endpoint even after the credential is swapped in.

None of this asks the agent to behave. It assumes the agent might do the attacker-shaped thing — decrypt a store, dump a vault, retry a blocked download — because Sophos just watched real ones do exactly that. The design decides that when it happens, the store is empty, the key is fake, and the destructive query stops at the door.

Agents now behave like the thing your defenses were tuned to stop, and you cannot fix that by asking them to behave. You fix it by changing where they stand. Give an agent a disposable machine with no saved passwords, a vault full of fakes, and a proxy that keeps the real secrets on the host — and the telemetry that lit up Sophos's dump becomes a process rummaging through an empty room. Install it, point it at a repo, and let it reach for whatever it wants.