Elastic, a San Francisco-based search and security software company, is warning that attackers are running commands through artificial intelligence (AI) agents, abusing approved information technology (IT) tools and logging in with stolen passwords within minutes, turning the trust enterprises place in such software against them.
“What’s new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control or even explain: AI agents. An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused,” Mike Nichols, general manager of security at Elastic, said in a press release.
“When an attacker is behind it, its activity looks exactly like the employee who installed it. So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing.”
Elastic sells search, observability and security software built on its Elasticsearch engine.
The findings come from threats, etc, a quarterly report series from Elastic Security Threat Command drawing on confirmed intrusions and research between April and September 2026. The company said it publishes quarterly because attacker tradecraft, including the abuse of AI agents, now changes too fast for an annual cycle.
In live intrusions, Elastic researchers saw attackers execute commands through Claude Code on Windows and the ChatGPT desktop app on macOS. In two of those cases:
On a Mac, a single command read an internal infrastructure document and then pulled saved passwords from the user’s keychain
On Windows, an attacker connected remotely, used Claude Code to stage tools and reached an outside server through a concealed connection
Elastic also forensically reconstructed the July breach at Hugging Face, an AI model-sharing platform, where an autonomous AI agent broke into production systems. Signs of the agent at work included duplicate commands seconds apart and a working exploit followed immediately by a basic coding error.
Stolen passwords at speed
Across 27 confirmed cases involving password-stealing malware, attackers logged in with stolen credentials an average of eight minutes after infection.
The most common entry point was a “ClickFix” lure, a fake prompt that tricks users into pasting and running a malicious command themselves. It started in 12 of the 27 cases, or 44%. The theft then kept running inside software the device already trusted, such as browser updaters and Apple’s built-in scripting tools.
In one healthcare case, attackers delivered malware about 16 seconds after tricking the user.
The company also confirmed 23 cases in which attackers installed legitimate remote IT software, most often ScreenConnect, to keep hands-on access to a device.
Elastic recommends that defenders inventory the AI tools, IT tools and signed software they trust, and judge them on behavior, such as what an AI tool launches or where a remote IT tool connects, rather than on whether they are approved.