As reported by Elastic Security Labs, researchers instrumented a Cursor-based AI coding agent environment to capture over 13 million tool calls, revealing just how much autonomous activity these agents generate — and how little of it most organizations are currently monitoring.

AI Security Alert: As reported by Elastic Security Labs, researchers instrumented a Cursor-based AI coding agent environment to capture over 13 million tool calls, revealing just how much autonomous activity these agents generate — and how little of it most organizations are currently monitoring.

Why This Research Changes the AI Security Conversation

The cybersecurity industry has spent years debating what AI could do. Elastic's work reframes that conversation around what AI agents are already doing — at scale, in real developer environments, right now. The scale of 13 million discrete tool calls from a single agent audit is not just a benchmark; it is a threat surface measurement. Every one of those calls represents a potential lateral movement vector, a data exfiltration pathway, or a supply chain injection point that traditional endpoint and SIEM tooling simply isn't built to see.

The critical insight here is architectural: AI coding agents don't just write code. They read files, execute shell commands, make outbound network requests via Model Context Protocol (MCP), and interact with external services — often chaining these actions faster than any human reviewer can track. Without purpose-built telemetry, defenders are effectively flying blind inside their own development pipelines.

The Attack Surface Nobody Is Measuring

From a threat modeling perspective, agentic AI introduces several novel risk categories that deserve immediate attention from security teams:
The Attack Surface Nobody Is Measuring
Prompt injection via file reads: When an agent reads a file containing adversarially crafted instructions, it may execute attacker-controlled logic. Without logging file read events, this attack is nearly invisible.
MCP request abuse: MCP servers extend agent capabilities to external tools and APIs. Each outbound MCP request is a potential exfiltration channel or command-and-control callback — and most organizations have zero visibility into these.
Shell command chaining: Agents executing shell commands can trivially traverse directory structures, access secrets in environment variables, or invoke binaries that bypass traditional DLP controls.
Dependency and supply chain manipulation: An agent with write access to package manifests (package.json, requirements.txt, go.mod) can be manipulated — through prompt injection or model hallucination — to introduce malicious dependencies.

Auditability as a Security Control

Elastic's approach of treating every agent action as a structured, queryable security event is exactly the right mental model. This isn't just about incident response after the fact — it's about enabling real-time behavioral analytics against agent activity. The ability to write ES|QL hunt queries over agent telemetry means defenders can establish baselines, detect anomalies, and build detection rules around agentic behavior the same way they would for human users or endpoint processes.

Shield53 Position: AI coding agents should be treated as privileged service accounts — not as developer tools. Every permission granted to an agent is a permission that can be abused, hallucinated into misuse, or injected into by an adversary.

The security community has a well-established principle: you cannot protect what you cannot see. That axiom applies with even greater urgency to AI agents, which operate at machine speed and can execute thousands of actions in the time it takes a human to read a single alert.

Who Is Most at Risk

Organizations with the highest exposure right now include:

  • Software development teams using AI-assisted IDEs (Cursor, Copilot Workspace, Devin, etc.) with broad filesystem and terminal access
  • DevOps and platform engineering teams where agents interact with CI/CD pipelines, secrets managers, and cloud infrastructure APIs
  • Financial services and healthcare firms subject to strict data handling regulations, where agent file reads may inadvertently touch regulated data
  • Any organization using MCP-enabled agents connected to internal knowledge bases, ticketing systems, or code repositories

Shield53 Recommendations

Immediate Actions

  • Instrument your agent environments now. Don't wait for a native security product. Use endpoint agents (Elastic Agent, Sysmon, osquery) to capture process executions, file access events, and network connections originating from AI agent processes.
  • Apply least-privilege to agent contexts. Scope filesystem access to project directories only. Disable shell execution capabilities unless explicitly required. Treat MCP server permissions like OAuth scopes — grant the minimum necessary.
  • Log and review all MCP traffic. Treat MCP request logs the same as you would API gateway logs — capture request destinations, payloads where possible, and flag any outbound calls to domains not on an approved allowlist.
  • Build behavioral baselines. Use your SIEM to establish what "normal" looks like for agent tool call patterns. Volume spikes, access to unexpected file paths, or new outbound endpoints are your early warning signals.
  • Include AI agents in your threat model. Update your application threat models to explicitly enumerate agent capabilities, trust boundaries, and data access scopes. Prompt injection should be listed as an explicit threat vector.
  • Test for prompt injection in your workflows. Red team your agent pipelines by placing adversarial instructions in files, comments, and external data sources the agent is likely to read.

Strategic Guidance for CISOs

AI coding agent adoption is accelerating faster than security governance frameworks can adapt. Security leaders should establish formal AI agent usage policies now — before agents are deeply embedded in production workflows. This includes defining approved agent platforms, required telemetry standards, and incident response playbooks for agent-related security events. The Elastic research demonstrates that this telemetry is achievable today with existing tooling; the blocker is organizational policy, not technology.