Attackers used approved AI tools as their shell | Elastic Threat Command

Elastic

Nov 4, 2026

Elastic confirmed two live intrusions in August 2026 where attackers ran commands through AI tools already on the victim’s machine: Claude Code on Windows and the ChatGPT desktop app on macOS.

Terrance DeJesus, principal security research engineer at Elastic Threat Command, explains why activity from a signed, approved AI tool is hard to triage, and why detection has to work at machine speed. He covers one case where it took an average of eight minutes from infostealer infection to an attacker attempting to log in with the stolen credentials, as well as a healthcare case where a ClickFix-based attack reached MSI delivery with DLL sideloading in roughly 16 seconds.

His guidance for defenders: Inventory what you trust, then detect behavior, not just binary signatures.

Chapters:

00:00 Attackers using approved AI tools as their shell

00:21 macOS: Reconnaissance, keychain dump, and filter in one command

00:41 Why a trusted parent process is hard to triage

00:57 Speed: 8 minutes and 16 seconds

01:36 What defenders can do

Read the November 2026 threats, etc quarterly report:
https://www.elastic.co/resources/security/report/threat-command-cybersecurity-report

Additional Resources:

Blog:
When trust becomes the payload: Inside the threats, etc quarterly report
https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust

Related research:
Living off the coding agent: Two tales of tunnels and LaunchAgents
https://www.elastic.co/security-labs/threat-command/coding-agent-launchagent-tunnel-detection

The report covers AI-assisted offense, supply chain, infostealers, RMM and dual-use tooling, vulnerability exploitation, and identity and AiTM.