When AI agents look like attackers: what behavioral telemetry tells us

Collection of Sophos X‑Ops posts (June–July 2026) covering how AI changes both attacker and defender dynamics. Key points: AI coding agents can mimic attacker behavior and trigger or evade endpoint detection telemetry; generative AI can turn patched bugs into functioning exploits within hours, exposing gaps from stalled exploit-mitigation approaches and prompting calls for default‑on mitigation layers; Vect and TeamPCP are collaborating on ransomware campaigns that leverage credentials harvested via supply‑chain compromises to enable large‑scale deployment; Sophos publishes a taxonomy of AI‑dr