Elastic finds Claude Code and ChatGPT abused in intrusions

Attackers used ChatGPT desktop and Claude Code to keep interactive access on compromised machines, according to Elastic’s quarterly threat report. Elastic published the report on November 5 and built it from confirmed customer intrusions and its own research between April and September 2026. Elastic concludes that signature-based detection misses these intrusions, because the payloads were signed, approved software and no malware was involved.

AI coding assistants were one of three kinds of legitimate software in those intrusions. The other two were remote monitoring and management agents and Microsoft first-party clients, and attackers used all three to stay on contested endpoints. As iTWire summarizes the report, coding agents are built to run system-level commands, and because a vendor signs them, they act as “explicitly trusted parent processes”. Commands started by an approved agent therefore carry the agent’s trust.

What Elastic tells defenders to watch

Elastic says a new signature rarely solves this. It recommends behavior analytics that learn what normal activity looks like for each user and machine, plus visibility and correlation across domains, since one attack chain now runs through containers, cloud control planes, legitimate users and software. At the endpoint, the report says to watch for outcomes such as memory tampering and proxy tunneling at the system level, whatever application starts them.

That comes with a cost Elastic names itself: broader visibility means many more alerts, so triage has to be automated to keep up with the attacks. The tool it offers for that is its own Elastic Workflows, which mixes ES|QL telemetry context, deterministic rules and AI reasoning to filter out benign activity before an analyst sees it. Per iTWire, Elastic describes the defender’s choice as alerting on every action an AI tool takes and drowning in noise, or trusting AI and IT tools by default and risking missed attacks.

The speed figures

In one AI agent-driven attack, Elastic reconstructed roughly 17,600 actions over just four days; iTWire reports that these actions come from the Hugging Face breach. In a confirmed healthcare case, a paste-and-run lure, where the victim is talked into pasting and running a command, led to MSI delivery with DLL sideloading in roughly 16 seconds. In some cases, attackers logged in with credentials stolen by an infostealer an average of eight minutes after the infection. The report also covers identity: adversary-in-the-middle phishing kits and gaps in legacy authentication let attackers get past MFA and into cloud and SaaS tenants through trusted applications.

The 23 confirmed findings of attackers installing legitimate remote-management software came between June 15 and August 12, with ScreenConnect named most often, and 12 of 27 confirmed infostealer findings began with a ClickFix-style paste-and-run lure, iTWire says. Elastic counts these as confirmed findings from its own telemetry, several of which can share one host or tenant, and says they shouldn’t be read as market share or global prevalence.

“An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused,” Elastic’s Mike Nichols said, per iTWire. “When an attacker is behind it, its activity looks exactly like the employee who installed it.”