Attackers ran commands through Claude Code and the ChatGPT desktop app during live intrusions, then logged in with stolen passwords about eight minutes after infection. That is the headline finding of a new quarterly report from Elastic Security Threat Command, published November 4 at 9:00 AM Eastern, according to Elastic's press release. The report, titled “threats, etc,” replaces the company’s annual Global Threat Report.
The reason this matters to American readers is simple. Many companies now approve tools like these for staff, and Elastic says defenders struggle to tell approved AI activity from malicious use. The research draws on confirmed intrusions and findings from April through September 2026, as TechJournal.uk reported. Elastic says it moved to a quarterly cadence because attacker tradecraft, including abuse of AI agents, changes faster than an annual report can track.
Recent weeks have brought stories about AI tools being tampered with. This report takes a broader view: the tools companies already trust are becoming the attack path itself.
Claude Code and ChatGPT appear in live intrusions
Researchers saw attackers run commands through Claude Code on Windows and through the ChatGPT desktop app on macOS. In one Windows case, the attacker connected remotely, used Claude Code to stage tools, and reached an outside server through a concealed connection. One Mac intrusion pulled saved passwords, according to the headline on Stocktitan's repost of the release.
The report’s foreword, from Elastic Security Threat Command, puts the problem bluntly: “The things people were told to trust are now being used against them.” itWire quoted the line.
The sources do not establish whether these AI products were misused, compromised or simply used as cover. They describe the tools as abused, not vulnerable. That distinction changes the response. A flaw in a product calls for a vendor patch, while a tool an attacker drives after it was already allowed calls for tighter permissions and closer monitoring of what the tool actually does.
Eight minutes from infection to stolen logins
Speed is the most alarming number in the report. Across 27 confirmed cases involving password-stealing malware, attackers logged in with stolen credentials an average of eight minutes after infection, according to SecurityBrief Australia and Elastic’s release.
| Figure | What it measures |
|---|---|
| 8 minutes | Average time from infection to a login using stolen credentials, across 27 cases |
| 12 of 27 (44%) | Cases that began with a ClickFix lure |
| 23 | Confirmed cases where legitimate remote IT software kept access in place |
| About 16 seconds | Gap between a healthcare user falling for a lure and malware delivery |
Eight minutes leaves little room for a daily alert review. A slow review cycle would likely arrive after the credentials are already in use. The healthcare example shows the front end can be just as fast, since malware arrived about 16 seconds after a user fell for a lure, according to CIO Influence.
Why ClickFix still works
ClickFix started 12 of the 27 cases, or 44 percent. The lure tricks the user into pasting and running a malicious command, so the first step depends on a person rather than a software bug. That share matters for training. Employees who paste commands from web pages or pop-ups are the entry point in many cases, and the attention on AI tools should not push that risk out of view.
USA 24 has covered a related pattern in phishing. Its story on fake suspended bank pages that hide phishing sites from takedown checks is a reminder that lures built to look routine remain a live threat.
Remote IT software that looks routine
Legitimate remote IT software, most often ScreenConnect, maintained access in 23 confirmed cases. Elastic says a signed, licensed remote monitoring tool is hard to flag because it is often already approved. That is the core defensive problem. An approval list that says yes to a product says little about what that product is doing right now, which is why Elastic urges defenders to judge trusted tools by behavior.
Remote access is also a target at the network edge. USA 24 reported that ransomware gangs have exploited a Palo Alto GlobalProtect flaw, CVE-2026-0257, in a separate story. The two risks overlap: whether access arrives through a vendor flaw or through a tool an employee already trusts, intruders want it.
Hugging Face shows what an AI agent can do
Elastic forensically reconstructed the July 2026 Hugging Face breach, in which an autonomous AI agent broke into production systems. Elastic argues that AI agents can carry out thousands of actions with limited human oversight, and that they can keep going through errors. USA 24 has covered the Hugging Face breach separately, and Elastic uses it as the reference case for the agent risk.
Elastic’s broader concern is that enterprises are deploying AI agents faster than security teams can fully monitor or control them. That part is new. Living-off-the-land tactics, where attackers abuse tools already on a system, are long-standing, and MITRE ATT&CK has a whole tactic built around them. Mike Nichols, general manager of security at Elastic, put it this way in the company’s release: “Attackers hiding inside trusted software isn’t new.” The novelty lies in which tools attackers now use and how quickly they reach stolen credentials.
What defenders should do now
Elastic recommends that defenders inventory the AI tools, IT tools and signed software they trust, and treat anything outside that list as suspect. The report’s guidance, as summarized across the coverage, points to four concrete steps:
- Inventory which AI tools, remote-access products and signed utilities are allowed, and treat anything outside that list as suspect.
- Limit the permissions each approved tool holds.
- Monitor what those tools do, not just whether they are approved.
- Watch for logins that follow a suspected infection within minutes.
For readers at home, the advice is simpler. Do not paste commands from unexpected prompts or “fix” instructions, and be cautious with remote-support tools you did not request. The report does not state that as a single recommendation. It is general guidance that fits the findings.
What the report does not show, and what comes next
The sample is small. The 27 password-stealer cases come from Elastic’s own research, and the report covers notable techniques and confirmed findings rather than overall prevalence. It does not show how often these attacks happen across the United States. Elastic did not name the victims or the threat groups behind the Claude Code and ChatGPT intrusions in the sources reviewed.
The sources also do not say whether OpenAI or Anthropic has responded or changed product defaults. The full “threats, etc” report and its methodology were not reviewed for this story, and the press release points to it for detailed recommendations. Security teams should read that document before changing policy.
Watch the next edition. Elastic chose a quarterly cadence because tactics are moving faster than annual reporting. If the next report finds more intrusions routed through AI agents, the approval lists most companies keep will need a behavior layer, and vendors of coding and desktop AI tools will face more pressure to explain what their products let an attacker run.
