{"id":237,"date":"2026-11-05T11:03:32","date_gmt":"2026-11-05T10:03:32","guid":{"rendered":"https:\/\/mspbusiness.com\/en\/it-news\/attackers-execute-commands-via-ai-agents-and-it-management-tools\/"},"modified":"2026-11-05T11:04:21","modified_gmt":"2026-11-05T10:04:21","slug":"attackers-execute-commands-via-ai-agents-and-it-management-tools","status":"publish","type":"post","link":"https:\/\/mspbusiness.com\/en\/security\/attackers-execute-commands-via-ai-agents-and-it-management-tools\/","title":{"rendered":"Attackers execute commands via AI agents and IT management tools"},"content":{"rendered":"

Attackers are using AI tools such as Claude Code and the ChatGPT desktop app to execute commands on compromised systems. That is the finding of a new quarterly report from Elastic Security Threat Command. Stolen credentials are used an average of eight minutes after an infection. Legitimate remote management software, such as ScreenConnect, is used to maintain access.<\/strong><\/p>\n

The report threats, etc<\/a> is based on confirmed attacks and Elastic’s own research covering the period from April to September 2026. The core finding is that attackers are exploiting the trust and broad system access that organisations grant to AI tools, AI agents and IT management software. According to Elastic, the report also includes the research data and detection rules that security teams can use to track down the same activity.<\/p>\n

AI tools as an execution layer<\/h3>\n

In real-world attacks, Elastic researchers observed commands being executed via Claude Code on Windows and the ChatGPT desktop app on macOS. In one attack on macOS, a command first read an internal document about the IT infrastructure and then extracted saved passwords from the user’s Keychain. In a case on Windows, an attacker connected remotely to a computer, used Claude Code to stage tools and established contact with an external server via a hidden connection.<\/p>\n

Mike Nichols, general manager of Security at Elastic, points out that abusing existing software is not a new technique in itself. MITRE ATT&CK even has a dedicated tactic for it. What is new, he says, is that organisations are deploying AI agents that security teams find difficult to monitor, manage or understand. An agent with credentials and internet access represents an additional attack surface, whether it is misconfigured or being abused. If an attacker controls the agent, that activity resembles the behaviour of the employee who installed the agent. Nichols therefore argues that the question is not whether a tool has been approved, but what that tool actually does.<\/p>\n

Eight minutes to the first login<\/h3>\n

In 27 confirmed cases involving infostealers, Elastic measured the time between infection and the first use of stolen credentials. The average was eight minutes. The most common entry point was a ClickFix lure: a fake message that tricks users into pasting and running a malicious command themselves. That was the starting point in 12 of the 27 cases (44 per cent). Data theft then took place via software the device already trusted, such as browser updaters and Apple’s built-in scripting tools. In one case in the healthcare sector, the malware was on the system roughly 16 seconds after the user had taken the bait.<\/p>\n

Traces of an AI agent at Hugging Face<\/h3>\n

Elastic also reconstructed the July 2026 data breach at Hugging Face on the basis of forensic analysis. The company reports finding indications that an AI agent was active during the breach. Commands were sometimes executed twice within a few seconds, and a successful attack was immediately followed by a simple programming error. According to the researchers, this kind of persistent activity makes it difficult for security teams to distinguish between normal agent behaviour and malicious actions at scale.<\/p>\n

In addition, Elastic confirmed 23 cases in which attackers installed legitimate remote management software to maintain access to a device. In most cases, this was ScreenConnect.<\/p>\n

Assessing behaviour rather than approval<\/h3>\n

Elastic Security Threat Command advises organisations to compile an inventory of trusted AI tools, IT tools and digitally signed software, and to treat everything outside it as suspicious. According to the researchers, trusted software should also be assessed on what it does, for example which programs an AI tool launches or which systems an RMM tool connects to. They further recommend mapping normal behaviour on systems and combining signals from cloud, endpoint and identity data. Elastic states that its own product, Elastic Security, monitors activity at system level and is designed to detect behaviour such as proxy tunnelling and memory manipulation, regardless of which application causes that behaviour.<\/p>\n

threats, etc is a series of quarterly reports that replaces Elastic’s annual Global Threat Report. The company has opted for a quarterly cadence because, according to Elastic, attackers’ methods change faster than an annual report can keep up with. The figures are based on confirmed findings and explicitly do not provide a picture of global prevalence.<\/p>\n

The full report can be read via threats, etc<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Attackers run commands via AI tools like Claude Code and use stolen credentials eight minutes after infection on average. RMM tools like ScreenConnect are abused for persistence.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"mspb_bron_id":1169576,"mspb_url_nl":"https:\/\/mspbusiness.com\/security-en-privacy\/aanvallers-voeren-opdrachten-uit-via-ai-agents-en-it-beheertools\/","mspb_url_de":"https:\/\/mspbusiness.com\/de\/security\/angreifer-fuehren-befehle-ueber-ki-agenten-und-it-verwaltungstools-aus\/","mspb_url_en":"","mspb_beeld_url":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/11\/hero-1793873000948.png","mspb_beeld_klein":"https:\/\/mspbusiness.com\/wp-content\/uploads\/2026\/11\/hero-1793873000948-768x432.png","mspb_auteur":"Redactie","mspb_beeld_alt":"","mspb_video":"","_yoast_wpseo_metadesc":"Elastic Security Threat Command sees attackers abusing AI tools and RMM software, and using stolen credentials within eight minutes of infection.","footnotes":""},"categories":[3],"tags":[],"layout":[6],"class_list":["post-237","post","type-post","status-publish","format-standard","hentry","category-security","layout-news"],"_links":{"self":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/comments?post=237"}],"version-history":[{"count":1,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/237\/revisions"}],"predecessor-version":[{"id":239,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/posts\/237\/revisions\/239"}],"wp:attachment":[{"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/media?parent=237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/categories?post=237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/tags?post=237"},{"taxonomy":"layout","embeddable":true,"href":"https:\/\/mspbusiness.com\/en\/wp-json\/wp\/v2\/layout?post=237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}