Does Your EDR See What Your AI Agents Do?

On 12 October, Minh Anh Day, founding engineer at my company EDAMAME, published Two Years After the Solana web3.js Backdoor, CrowdStrike Still Doesn’t Flag It. Minh Anh rebuilt the December 2024 backdoor of the @solana/web3.js library, pointed it at fresh domains, and ran both variants on a customer’s Mac where CrowdStrike Falcon, at its latest release as of 1 October 2026, ran next to EDAMAME. EDAMAME raised an alert on both variants and named the exfiltration host. Falcon raised no alert on either.

That is one result, for one product, on one attack, and I will not stretch it further. It does raise a question that every security team that has let AI agents onto its workstations should be able to answer: does the endpoint stack you already run see the attacks that now arrive through those agents? Nobody should take a vendor’s word on that, including mine. This post names the twelve publicly documented attacks we reviewed in September 2026, explains how EDAMAME sees them, and ends with a free tool that lets you check your own EDR on your own machine.

The Attack Simulator after the run: eight scenarios started, eight detected by EDAMAME.

The two-minute video of this run is on YouTube: youtu.be/pFJsOpwQ_uA

It is a live run on a real Mac on 27 October 2026, with EDAMAME Security 2.2.0 and the Attack Simulator 2.2.0, on test data only. Eight scenarios, each modelled on a public incident, were started a few seconds apart: the litellm, axios and Shai-Hulud supply-chain compromises, the Rules File Backdoor, CurXecute, SneakPeek, s1ngularity and the Claude Code WebSocket flaw. EDAMAME raised a finding on all eight, between 12 seconds and 1 minute 53 seconds after each scenario started.

What AI agents change on the endpoint

An AI agent such as Cursor, Claude Code, Claude Desktop, Codex, OpenClaw or Hermes runs with the access of the person who started it. It reads the code, the configuration and the credentials that person can read; it installs packages, runs commands, calls tools and opens network connections. Two things follow, and neither is visible in a list of running processes.

The first is that the software supply chain now reaches the workstation through the agent. When an agent runs npm install or pip install, the install scripts of every package it pulls run with the same keys within reach. Shai-Hulud, the self-replicating npm worm of September 2025, harvested SSH keys and tokens from inside node_modules, wrote itself outside the package folder so that it would run again, and republished itself into other packages. The TanStack compromise of May 2026 read a CI runner’s memory for its identity token and used it to publish poisoned packages; it wrote nothing to disk and contacted no known-bad domain.

The second is new. An agent turns what it reads into what the machine does. A chat message, a web page, an MCP tool description or a rules file in a repository is untrusted content; the model reads it, and the result is a write to a configuration file, a credential read or a network connection. The attacks that live at that junction have no malicious file and no malicious domain to match:

• CurXecute, CVE-2025-54135: an attacker’s message in a Slack channel carried hidden instructions. When Cursor was asked to summarize the channel through its MCP connection, it rewrote its own MCP configuration and ran the attacker’s command. Cursor fixed it in version 1.3.

• The Rules File Backdoor: instructions hidden in an AI editor’s rules file with invisible Unicode characters. A reviewer sees a clean diff; the model reads the hidden text and follows it.

• MCP tool poisoning: a tool description carries hidden instructions, and the tool acts beyond its stated purpose.

• SneakPeek (Noma Labs, 2026): content rendered in Claude Code Desktop’s preview pane could read SSH private keys, cloud credentials and tokens from the home folder and send them out. The researchers report that they found a way around the first fix.

Seen event by event, each of these is a signed, allow-listed program doing something it is allowed to do: an editor writing its own configuration, a desktop app reading files in the user’s home folder, a package manager running a script. Whether it is an attack depends on what the agent was asked to do, and that is information a sensor built to grade processes and known indicators does not have. Part one showed the same property for a backdoor hidden in a library; with agents it is the ordinary case.

The twelve real attacks

In September 2026 we reviewed twelve publicly documented incidents, from 2021 to 2026, against the detections EDAMAME already ships. Eleven exercise a technique EDAMAME detects with no update. The twelfth, the XZ Utils backdoor, is caught at the moment it is exploited, not while it sits dormant, so we count it as partial. Each name links to a public write-up.

1. TanStack npm compromise (2026). Code running inside a CI job reads the runner’s memory for its short-lived identity token, then publishes poisoned packages. Nothing is written to disk. Caught by behavioral detection of the cross-process memory read. No update.

2. Shai-Hulud npm worm (2025). An install script harvests SSH keys and tokens, writes itself outside node_modules to persist, and republishes itself into other packages. Caught by behavioral detection of the install-time write and the credential read; intent divergence as well when the install runs inside an agent session. No update.

3. Cursor CurXecute, CVE-2025-54135 (2025). A prompt injection arriving through an MCP tool rewrites the agent’s MCP configuration and runs the attacker’s command. Caught by intent divergence (the planted command reaches a destination the task never declared) and behavioral detection of the write to the agent’s configuration. No update.

4. Rules File Backdoor (2025). Hidden instructions planted in the agent’s rules file steer the code it generates. Caught by behavioral detection of the write to the agent’s configuration. No update.

5. Claude Code WebSocket flaw, CVE-2025-52882 (2025). A malicious web page reaches the local IDE extension and runs commands. Caught by intent divergence (an attacker command under the agent’s lineage reaches an undeclared destination) and behavioral detection of a token holder sending data out. No update.

6. MCP tool poisoning (2025). A tool description carries hidden instructions, and the tool then acts beyond its stated purpose. Caught by intent divergence (an undeclared sensitive-file read or destination) and behavioral detection of the unsanctioned destination. No update.

7. Exposed Ollama servers (2025). Local LLM servers bound to a public interface with no authentication. Caught by intent divergence (a listening port the plan marks as not expected) and the host’s open-port posture check. No update.

8. PyTorch torchtriton (2022). A dependency-confusion package harvests credentials and tunnels them out over DNS. Caught by behavioral detection of the credential harvest and the DNS tunnel; intent divergence as well when the install runs inside an agent session. No update.

9. Codecov Bash Uploader (2021). A modified uploader ships the CI job’s environment secrets to an attacker’s host. Caught by behavioral detection of the secret harvest followed by egress. No update.

10. GitHub OAuth tokens stolen through Heroku and Travis CI (2022). Stolen OAuth tokens are used to pull private repositories. Caught by behavioral detection of a token holder reaching an unusual destination. No update.

11. CircleCI breach (2023). Malware on an engineer’s laptop steals a live session token. Caught by behavioral detection of token exfiltration from the infected host. No update.

12. XZ Utils backdoor, CVE-2024-3094 (2024). A validly signed, dormant build-time backdoor in a system library. Caught by behavioral detection at exploitation (an unsigned code path from sshd). Partial: caught when exploited, not while dormant.

Two qualifications belong next to that figure. Intent divergence needs an agent that declares its plan: it applies to four of the twelve on its own, and to six when the install step runs inside an agent session. A CI runner or an infected laptop with no declared plan is caught by the behavioral detection alone. And “no update” does not mean that EDAMAME never updates: when an attack brings a new indicator, such as a newly known bad destination, it reaches the fleet within minutes as a cryptographically signed threat model, with no new app version and no restart. Only a genuinely new sensor capability needs an engineering release.

How my company EDAMAME sees them

EDAMAME observes every process on the machine from outside the agent, through the observation interfaces the operating system provides: Endpoint Security on macOS, eBPF on Linux and ETW on Windows. It ships no kernel driver of its own and puts no plugin inside the agent, so a compromised agent cannot pause or silence it. From that one stream of evidence it draws two kinds of findings (more on the AI agents page).

The first grades the technique rather than the indicator. A hash or a domain becomes known only after someone has found the attack. What an attacker can do on a host is a much smaller set: one process reading another’s memory, an install-time script writing outside its package tree, a credential file read and then a connection out, a key sent to a service it is never used with, a program running from a temporary folder that reaches the network. Eleven deterministic checks grade that evidence, so a new attack that reuses a known technique needs no update to be caught.

The second compares what the agent says it is doing with what the machine actually does. The agent’s declared task, the destinations it expects and the files it means to touch are set against every connection, file access and process observed under its lineage. Each observation the plan does not explain becomes a piece of evidence, and a language model weighs the result against the task. It can clear soft signals; it can never clear critical evidence, nor an agent reaching beyond its declared scope. That is how CurXecute’s planted command shows up: it reaches a host that summarizing a Slack channel never needed.

Findings appear in the EDAMAME Security app and, for a fleet, in EDAMAME Hub, which can withdraw a machine’s access to GitHub, GitLab, Microsoft Entra, Google, NetBird, FortiGate, Tailscale and Netskope until it is back in policy.

Test your own EDR

We built the EDAMAME Attack Simulator for demos, and it runs the same trigger scripts as the release gate we hold EDAMAME to. It is free, for macOS (Apple silicon), Windows and Linux, and it holds 27 scenarios in six themes: attacks on the AI agents themselves, the software supply chain, credential theft, data exfiltration, file tampering, and network behavior. Each scenario reproduces the host-visible behavior of a real attack or a documented technique on test data: decoy credentials, harmless test processes and placeholder files. Nothing real is attacked and no real secret leaves the machine.

Eight of the twelve incidents above have a scenario: CurXecute (a rogue MCP entry written into an AI agent’s configuration), the Rules File Backdoor, MCP tool poisoning, the Claude Code WebSocket flaw, the persistence step of Shai-Hulud, the memory read behind TanStack, the CI-environment read behind Codecov, and the exploitation shape of the XZ backdoor. Others replay recent incidents: the axios and pgserve npm compromises, the litellm PyPI compromise, s1ngularity and SneakPeek.

The simulator does not need EDAMAME to run. It produces the activity, and whatever watches the machine decides whether to see it. Install it on a test machine protected by your EDR, start a scenario, and look at your EDR console. Then install EDAMAME Security, which is free, on the same machine and run the scenario again. EDAMAME’s finding appears in Security, then Detections; with EDAMAME’s command-line tool installed, the simulator also shows when the finding landed and at what severity.

A few practical points before you start:

• Use a test machine, and tell your security team first. To look real, scenarios write decoy credentials into the folders an attacker would read (.ssh, .aws, .cursor, .claude and others). One edits an AI agent’s MCP configuration after backing it up, and one connects to addresses listed on public threat-intelligence blocklists, sending only harmless filler.

• Two scenarios need an administrator password; the others run as you.

• Give each scenario a few minutes before concluding anything.

• Press Run cleanup when you are done: it stops every scenario, restores the files it changed and removes its decoys.

Read the result in both directions. A scenario your EDR does not flag is a signal worth investigating, not proof that it would miss the real attack: the simulation reproduces what the attack does on the host, not the malware itself. Put the question to your vendor with the scenario, the incident it is based on and the time you ran it. And when your EDR does flag a scenario, look at what it names. The process, the file and the destination are what your team will need on the day it is not a simulation.

The simulator, its downloads for macOS, Windows and Linux, and their checksums are on its GitHub page. EDAMAME Security is a free download, and the Demo Center shows short videos of these detections. I would rather you ran the test than took my word, or anyone’s, for what your machines see.