Why EDR doesn't detect AI agents, and how to close the gap

EDR doesn't flag AI agents because, to EDR, they aren't threats. Coding agents such as Claude Code, Cursor and GitHub Copilot run as signed, legitimate processes under the employee's own account, run the same shell commands a developer would, and talk to well-known AI APIs over HTTPS. EDR is built to answer "is this malicious?", and for most agent activity the honest answer is no. The risk an AI agent carries is a different question: what is installed, what it can reach, who approved it and what it did. Answering that takes an inventory and access controls next to EDR, not a better signature.

What EDR is built to see

Endpoint detection and response watches processes, files, the registry and network connections on each device, and compares what it sees with known attack patterns: malware signatures, exploit chains, credential dumping, odd parent and child processes, lateral movement. It is very good at that, and it should stay. But its model is built around software doing something an attacker would do. AI agents mostly do what the employee would do, only faster and with less oversight.

Why AI agents slip past it

They run as ordinary, trusted processes

A coding agent is usually node, python, a signed CLI or an IDE extension, started by the user. Microsoft's Defender team made the same point in June 2026, describing local agents as running like ordinary processes that most security teams cannot see into. Nothing about the process tree looks unusual.

They act with the employee's identity

Agents use the employee's shell, git credentials, cloud CLI sessions, browser cookies and SaaS tokens. A deleted folder, a git push or an API call made by the agent is indistinguishable from the employee doing it, because it is made with the same credentials. Browser agents go a step further and act inside the employee's signed-in browser session, so every click is an ordinary web request from a trusted device.

Their traffic looks like any SaaS app

Agents send prompts and receive actions over TLS to well-known, allowed domains run by the AI vendors. To EDR and to most network tools this is the same as any other approved SaaS traffic.

MCP servers are a new class of local software

Model Context Protocol (MCP) servers are small programs that give an agent tools, often launched straight from a public package registry and holding tokens to systems such as GitHub, Jira, Google Drive or a database. OWASP's MCP Security Cheat Sheet lists the risks: local servers running with full host access, typosquatted or tampered packages, tool definitions that change after you approve them, hidden instructions in tool descriptions, over-scoped tokens, and data leaving through tool calls that look normal.

Prompt injection needs no malware

An agent that reads a web page, a ticket, a pull request or an email can be steered by instructions hidden in that content. Nothing malicious is written to disk; the agent does what it was told, with the permissions it already had. OWASP's Top 10 for LLM applications lists prompt injection first and "excessive agency", giving a model more autonomy and access than the task needs, as a separate risk.

Employees install them themselves

Most AI tools arrive through self-service: a CLI install, an IDE extension, a browser extension, an OAuth grant to a SaaS app. None of these goes through procurement, so there is often no record that they exist, and no owner to ask.

EDR vendors are starting to add agent visibility

This is changing. In June 2026 Microsoft previewed AI agent discovery in Defender for Endpoint: it identifies more than 20 types of local agents on managed Windows and macOS devices, maps each one to its user, device and MCP connections, and blocks malicious activity at runtime for Claude Code and GitHub Copilot CLI. Palo Alto Networks and several startups now market similar agentic endpoint products. If you run Defender, turn the preview on.

Even with agent-aware EDR, most questions IT and security get asked about AI are governance questions rather than detection ones: which tools are approved, who has them, what they cost, what they can reach, and who said yes.

How to close the gap

1. Inventory the AI tools you already have. Combine installed-software data from device management, SSO and OAuth app grants from the identity provider, and usage data from the AI vendors' admin APIs. Each source sees a different slice, and none sees all of it.
2. Make sure EDR itself is everywhere. Agent-aware EDR only helps on devices where the EDR agent is installed, current and reporting. Reconcile the EDR console against your device inventory and chase the gaps; our guide to finding unmanaged devices walks through it.
3. Publish an approved list and a fast request path. Employees route around bans. Give approved AI tools a catalog entry with an approval step, so asking is easier than installing.
4. Scope the credentials agents use. Prefer per-tool tokens with narrow OAuth scopes and short lifetimes, keep secrets out of plaintext config files, and keep production credentials off laptops where you can.
5. Keep a human in the loop for destructive actions. Most coding agents and MCP clients support approval prompts. Leave auto-approve off for shell commands and for writes outside the project.
6. Log tool calls centrally and review them like any other privileged access.
7. Review unused and unapproved tools on a schedule. Remove access to AI tools nobody has used in 60 days, and follow up on new ones as they appear.

Where Harmony fits

Harmony isn't an EDR and doesn't replace one. It covers the governance side. AI governance discovers applications from your identity provider and flags unapproved ones on a schedule, and AI spend tracking shows usage and estimated cost per person for Claude, ChatGPT, Microsoft Copilot and Cursor. Access and spend requests go through approvals in Slack or Teams. On the endpoint side, the EDR Status Discovery and EDR Misconfiguration Detection agents flag devices where CrowdStrike, SentinelOne or Microsoft Defender for Endpoint is inactive, outdated or misconfigured, so the EDR you rely on is actually there.

This article is written by Harmony. Claims about other vendors come from their public pages, listed under Sources and checked in November 2026.