AI Adoption Overwhelms Security Operations with Rising False Alerts

AI-related alerts still account for only 0.43% of all SOC alerts. And that share is climbing every single month, up 685% between February and June 2026.

Those two figures — a small present share and explosive recent growth — come from Intezer’s investigation of roughly 16.9 million SOC alerts. About 73,000 of those alerts (0.43%) were related to AI tools or agents. The pattern the company found is not a sudden wave of breaches; it is a rising tide of activity that looks like trouble and, far more often than not, is not.

The new shape of the alert stream

Intezer separates enterprise AI adoption into two concurrent behaviors that converge in the SOC. One is technical: developers installing coding agents that spawn shells, read credential stores, open tunnels, download packages and run security tooling — legitimate work that looks, to legacy detection rules, like the early stages of an intrusion. The other is human: employees granting OAuth consent to third‑party AI applications, pasting documents into generative tools, and otherwise moving corporate data into external models. Both land in the same alert stream and both need different handling.

The quantitative side is clear: AI alerts are the fastest‑growing slice of the stream. Every full month in the study is higher than the one before; growth accelerated sharply in May 2026. A SOC that sizes AI‑alert handling to today’s volumes will likely be under‑provisioned within a quarter.

Real attacks: phishing that leverages AI brands

Real attacks made up roughly 0.02% of AI‑related alerts in Intezer’s data. Importantly, none of the confirmed compromises were caused by an organization’s own AI agent executing malicious code. Instead, the genuine attacks observed tended to “ride on” AI adoption — social engineering that weaponizes familiar AI brand names as lures.

• One phishing example used the subject line “RE: Anthropic Engagement approval & payment,” invoking a supposed contract or invoice to support an invoice fraud story.
• Another impersonated Google’s Gemini Ads with a lure that looked like a workspace invitation but relied on the suspicious domain gemini-advertisers[.]com.
• A third email claimed “OpenAI Partner Summit 2026” but originated from noreply-zoomevents@zoom.us; the Zoom registration flow was used to lend credibility to a fraudulent invitation.

Investigators also saw instances where agents invoked toolchains usually associated with attacks — for example, Cursor executing a MiniDump via comsvcs.dll in a parent‑child chain (Cursor.exe → powershell.exe → rundll32.exe). In many such cases, closer inspection showed the activity was developer debugging or automation rather than attacker action, underscoring how context dissolves apparent “attacks.”

Unsafe use: permission‑bypass flags, tunnels, and exposed secrets

About 5.8% of AI‑related alerts corresponded to genuine security risks rather than confirmed compromises. The central problem is agents running with permission‑bypass flags (examples described as “--yolo” in some tooling), allowing automated actions without user prompts. Those invocations are legitimate developer work in many cases — and precisely the precondition an attacker could exploit.

• Intezer documented a coding agent launched with permission bypass that enabled an attacker in a publicly documented supply‑chain incident to execute malicious code because prompts were disabled.
• Other real exposures included an AI IDE spawning PowerShell which launched ngrok and opened a reverse tunnel to the public internet using the user’s auth token; and an agent dumping the entire macOS keychain via “security dump-keychain > /tmp/,” briefly exposing stored secrets.
• The team also observed multiple OAuth consent events: “first sign-in to a new application: OpenAI,” repeated OAuth grants to ChatGPT, and clusters of generative‑AI upload alerts — the surface where corporate data can leave the environment and where prompt injection or a compromised AI account could grant unauthorized access.

Noise: legacy detections tripping on Claude, Codex, Cursor

Noise dominated. Intezer classed 94.1% of AI‑related alerts as legitimate activity that tripped detections written before agents existed. False positives were pervasive: benign shares for the noisiest detections ranged from 77% to 99%. One single detection at one customer — a Windows binary Expand.exe flagged as a lateral‑tool transfer — accounted for 55% of all “critical” verdict alerts of that type; inspection found a developer’s coding agent setting up a normal shell.

Vendor binaries and installers are frequent culprits. For example, a verified Anthropic Claude Desktop installer triggered EDR rules such as “Ransomware Operations detected” and “Encoded PowerShell Download and Run” because its installer and updater chains (Claude Setup.exe → Update.exe → squirrel.exe) match behaviors those rules were designed to catch. Other examples include codex.exe invoked with “--yolo.” Even the single relatively severe cluster (ClickFix) leaned into risk because it intersected with permission‑bypass usage.

What this means for technologists, enterprise leaders, and end users

• Technologists and security teams: The highest‑value near‑term action is tuning legacy detections so routine agent activity does not flood analysts with maximum‑severity alerts. Intezer also recommends proactively hunting for permission‑bypass flags, unauthorized tunnels, and risky OAuth grants rather than waiting for an alert to appear.
• Enterprise procurement and policy owners: Define and enforce policies for what information can be shared with third‑party AI platforms, and require mitigations (harnesses or restrictions) for agents run with permission bypass.
• End users and developers: Run AI tools in isolated environments — containers or virtual machines — to limit agent access to credentials and sensitive resources and to make agent behavior distinct from the user’s own actions.

Intezer’s synthesis is stark: AI adoption has not, as of this study, produced a flood of agent‑enabled breaches. It has produced a rapidly growing set of alerts that are overwhelmingly false and a smaller but material set of exposures — permission‑bypassed agents, open tunnels, keychain dumps, and OAuth grants — that those alerts tend to bury. The practical work for SOCs is therefore less about inventing new detections than about teaching detection engines what normal AI behavior looks like and tuning the noisy legacy rules before alert volume doubles and triples again.

Original reporting and analysis by Intezer; article contributed by Nicole Fishbein. Read the source here: https://thehackernews.com/2026/09/when-whole-company-adopts-ai-what-it.html