Attackers Hide Inside Approved AI Tools, Elastic Warns

Eight minutes. That's the average gap between a password-stealing infection and attackers logging in with the stolen credentials, according to Elastic's latest threat research. In one healthcare incident, malware landed just 16 seconds after a user clicked a malicious prompt.

The findings come from Elastic's Threats, Etc. report, released last week, and they land on an uncomfortable truth for enterprise security teams: the tools you approved are now the tools attackers are using against you.

Mike Nichols, general manager of security at Elastic, puts it plainly: "Attackers hiding inside trusted software isn't new. Defenders have been fighting living-off-the-land techniques for decades."

But something has shifted. "What's new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain – AI agents," he said.

How are AI assistants being weaponised?

Elastic's researchers documented attackers executing commands through Claude Code on Windows and ChatGPT desktop on macOS. These aren't exotic exploits — they're mainstream productivity tools running in enterprise environments.

The report details the mechanics:

• On macOS, a live intrusion used a single command to read an internal infrastructure document, then pull saved passwords from the user's keychain.
• On Windows, an attacker gained remote access to a computer and used Claude Code to prepare tools and build a concealed connection to an external server.
• The July 2026 Hugging Face breach, forensically reconstructed by Elastic researchers, showed an AI agent executing thousands of actions with minimal human intervention.

That last point deserves a pause. The reconstruction found the AI agent repeating commands seconds apart — a working exploit followed immediately by a basic coding error, over and over. Machine-speed trial and error, inside a trusted pipeline.

What does this change for security teams?

The core dilemma, as Elastic frames it, is a bind: either you alert on every single action your AI tools take and drown in noise, or you trust them and risk missing a real attack.

Nichols argues the question has moved. It's no longer whether software is approved — it's whether you understand how it behaves and whether its actions are legitimate.

The speed data sharpens that point. Across 27 confirmed cases involving password-stealing malware, attackers logged in with stolen credentials an average of eight minutes after infection. ClickFix — a fake prompt that tricks users into running malicious commands under the guise of fixing a technical problem — was the entry point in 12 of those 27 cases, or 44 per cent.

From there, attackers didn't need custom tooling. They leaned on software already trusted on the system, including browser updaters and Apple's built-in scripting tools, to keep moving.

What should enterprises actually do?

Elastic's recommendations are practical rather than panic-driven:

• Maintain an inventory of trusted AI and IT tools, plus signed software. Treat anything off the list with caution.
• Stop equating "approved" with "safe." Monitor how applications behave, not just whether they're whitelisted.
• Correlate signals across cloud, endpoints and identity data to surface behaviour that looks wrong for the tool in question.

The uncomfortable takeaway for CIOs: the perimeter you're defending now includes AI agents whose actions your team may not be able to fully explain — and attackers have noticed.