An AI coding agent with shell access is, from a security tool's point of view, an invisible extra employee. It runs commands, installs packages, edits configuration and reads whatever files its task seems to need, all under the developer's own account and inside processes the developer launched. Endpoint detection tools cannot tell that work apart from the human's.
Elastic's security team hit that problem on its own fleet and decided to fix it with logging. In a writeup from Elastic Security Labs, the team describes wiring the hooks that the Cursor editor exposes to a 280-line shell script that records every tool call the agent makes, then shipping those logs to Elasticsearch with the agent already installed on each endpoint. Since the rollout in May they have collected over 13 million tool-call events from more than 1,100 machines and nearly 900 distinct users.
Why it matters
Elastic frames the gap around three questions a security team cannot currently answer. During an incident, was a given command typed by a person or generated by a model that had been steered by a poisoned README or a malicious Model Context Protocol server? While threat hunting, which machines ran an agent that read a file matching *.pem last week? And for governance, which MCP servers do engineers actually connect to, given each one is a third party with tool-level access to a developer's conversation?
That last one is not hypothetical. IntelFusions has covered hidden image instructions that trick coding agents into leaking secrets and a zero-click compromise of Cursor through MCP configuration. In both cases the interesting evidence would have been the agent's own tool calls, which nobody was recording.
What the data showed
Some of the findings ran against intuition. File reads dominate by roughly four to one over shell execution, so most of what a coding agent does is reconnaissance of the codebase rather than running commands. The headless command-line version of the agent, the one used in CI jobs and scripted runs, accounted for nearly a fifth of events, which install counts would never have revealed. And the MCP inventory turned up more than 300 distinct servers, with 86% of them used by only one or two people.
How it is built
Cursor can call an external program at defined points in the agent loop, and for some of those events the program's answer decides whether the action proceeds. Elastic deliberately used that as a sensor rather than a control: the script approves everything and records everything, and it answers the blocking events first so a logging failure can never stall a developer. The team compares it to a flight recorder, which never flies the plane.
Two deployment traps cost the team real time, and both are worth knowing before anyone copies the pattern. Cursor splits hook command paths on spaces, so a script stored under a directory whose name contains a space silently never runs. And Cursor reads its hook configuration only at startup, so every machine shows as deployed while collecting nothing until the editor is restarted.
The privacy line
The decisions that made the rollout work were mostly not technical. The collector records metadata only: the command line, the file path, the tool name, and never file contents, prompts or model responses. Access to the resulting index is restricted with field-level security so general security roles cannot read it at all. And the team published an internal page explaining exactly what was collected and who could query it before the fleet deployment started. Any organisation considering the same instrumentation should plan that conversation first, because a detailed record of how individual engineers work is sensitive whatever its security value.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.