Cyber attackers are increasingly exploiting approved IT tools and AI assistants to infiltrate enterprise systems, execute commands, and abuse legitimately signed remote monitoring tools, according to research by search and AI software company Elastic.
Elastic’s threats, etc report, released last week, found that security teams face the growing difficulty of distinguishing between legitimate activity and malicious behaviour within approved software. They face the dilemma of either getting alerts on every action of their AI tools, or trust their AI and IT tools and risk missing real attacks.
“Attackers hiding inside trusted software isn’t new. Defenders have been fighting living-off-the-land techniques for decades,” said Mike Nichols, general manager of security at Elastic.
“What’s new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain – AI agents,” he added.
He said the challenge for security teams is no longer simply determining whether software is approved, but understanding how it behaves and whether its actions are legitimate.
AI applications are new attack vectors
Elastic’s research found that attackers are executing commands through Claude Code on Windows and ChatGPT desktop on macOS.
According to the company, there was a case of a live intrusion on macOS, where a single command read an internal infrastructure document and then pulled saved passwords from the user’s keychain.
In another case, an attacker remotely accessed a Windows computer, and used Claude Code to prepare tools, and build a concealed connection to an external server.
According to Elastic, the July 2026 Hugging Face breach showed how AI agents can execute thousands of actions without the need for much human intervention.
Elastic researchers had done a forensic reconstruction of the breach and found that an AI agent is able to repeat commands seconds apart, with a working exploit followed immediately by a basic coding error.
Damaged caused within seconds
The Elastic report also highlighted the speed at which attackers can exploit compromised credentials. Across 27 confirmed cases involving password-stealing malware, it found that attackers logged in using stolen credentials an average of eight minutes after the initial infection.
The most common entry method was ClickFix, a fake prompt that tricks users into executing malicious commands under the guise of resolving a technical issue. ClickFix was the starting point for 12 of the 27 cases, or 44 per cent.
Then the attackers would rely on software that is trusted and existing in the system, including browser updaters and Apple’s built-in scripting tools, to continue their activities.
In one incident involving a healthcare organisation, attackers delivered the malware about 16 seconds after a user responded to a malicious prompt.
Elastic suggests that companies maintain an inventory of their trusted AI and IT tools, and signed software, and treat those not on the list with caution. The company highlighted that security teams should not view approved applications as safe, but should instead monitor how the applications behave, and correlate signals across cloud, endpoints, and identity data to identify unusual behaviour.
