Over the last twelve months, security teams have noticed a new breed of alert popping up in their security operations centers, expanding at a pace that outstrips every other signal in the feed. These alerts are not the result of attackers targeting AI systems; they stem from the routine use of artificial intelligence inside the organization—developers invoking coding assistants, business users granting OAuth consent to consumer‑grade AI apps, and employees pasting documents into generative models. Because these activities look benign to the people performing them, they often fly under the radar of traditional security awareness, yet they generate a steady stream of notifications that analysts must triage.
When we examined the data from numerous enterprise environments, two figures stood out as the foundation for the discussion. AI‑related alerts presently make up only 0.43 % of the total alert volume, but that proportion is climbing relentlessly, having surged 685 % between February and June 2026. In other words, AI is still a modest slice of the overall noise, yet it is the fastest‑growing slice, suggesting that any security team that bases its staffing on today’s numbers will find itself under‑resourced within a single quarter.
The real value of these alerts lies not in their quantity but in their makeup. We sorted every AI‑triggered notification into three buckets: genuine attacks, legitimate security risks, and harmless noise. The distribution revealed that 94.1 % of the alerts are noise, 5.8 % represent real security exposures, and a mere 0.02 % correspond to actual compromises. This means that the cost of AI to the SOC so far is not a wave of breaches but a rising tide of false alarms that obscure a quieter set of genuine concerns.
To understand why the alerts look so alarming, it helps to view AI adoption as two parallel behaviours arriving simultaneously. On the technical side, developers install coding agents that spawn shells, read credential stores, open network tunnels, download packages, and even run security tools—all as part of normal work. To a detection engine written before the age of AI agents, this activity mirrors the early stages of an intrusion, making it the loud and dominant source of alerts. On the human side, non‑technical staff frequently grant OAuth permissions to third‑party AI applications, share files, and paste sensitive data into generative‑AI chatbots. This quieter stream rarely trips endpoint controls, but it is precisely where data can leak out of the organization.
The sheer volume of AI‑related alerts, while still modest in absolute terms, is accelerating fast. Across the roughly 16.9 million SOC alerts we reviewed, about 73 000 fell into the AI category, representing that 0.43 % figure. The month‑over‑month increase has been steady, with a pronounced jump in May 2026 that pushed the six‑month growth to 685 %. Security leaders should treat the current percentage as a floor, not a ceiling, and plan for continued expansion; otherwise alert fatigue will set in before the underlying risks are even addressed.
Because most detection rules were authored before AI agents became commonplace, many of them fire at high severity on perfectly legitimate agent behaviour, turning noise into seemingly critical alerts. A telling example involved a single detection at one customer that accounted for 55 % of all “critical” verdicts flagging the Windows binary Expand.exe as a lateral‑tool‑transfer. Upon investigation, the activity turned out to be a developer’s coding agent setting up a shell environment—a routine step in their workflow. The lesson is clear: severity labels on AI‑related events must be interpreted with skepticism and validated before escalation.
The smallest bucket, representing actual attacks, contains only 0.02 % of AI‑generated alerts. In our dataset, none of these alerts traced back to a compromise caused by the organization’s own AI agent. Every alert that screamed “AI agent running mimikatz” or “reverse shell from a coding tool” proved, after careful inspection, to be either legitimate developer activity or a detection misfire. The genuine threats we did observe were not AI‑agent driven intrusions but rather phishing campaigns that hijacked popular AI brand names as lures, exploiting the familiarity employees now have with those notifications.
The middle bucket, comprising about 5.8 % of the alerts, holds the signals that security teams should prioritize. These alerts flag unsafe uses of AI tools that have not yet resulted in a breach but create material exposure. The most common issue is the use of a permission‑bypass flag (often labeled something like –yolo) that tells the agent to stop asking for user confirmation before executing commands. While many users trust the agent not to run harmful code, the data show that agents frequently succeed in executing risky actions when this guardrail is removed, opening the door to credential leakage, unauthorized network tunnels, or unintended system modifications.
To mitigate this risk, experts recommend coupling the permission‑bypass mode with additional safeguards—referred to as harnesses—that programmatically restrict the agent’s ability to invoke dangerous commands. Our analysis revealed that the same permission‑bypass invocations that generate genuine risk also constitute the largest source of false positives, because detection engines flag the powerful behaviour as malicious even when it is authorized by the user. Recognizing this dual nature helps teams focus on tightening configurations rather than merely chasing alerts.
The overwhelming majority—94.1 %—of AI‑related alerts fall into the noise category. This noise is not random; it is highly patterned and stems from legacy detection rules that were never designed to accommodate the normal operations of AI agents. For instance, the genuine installer for Anthropic’s Claude Desktop, verified by a valid code signature, routinely triggers EDR rules such as “Ransomware Operations detected” and “Encoded PowerShell Download and Run” across multiple customer environments. The installer is benign, yet the detection logic interprets its behavioural signatures as ransomware‑like activity.
Beneath these installer‑false positives lie countless agent‑behaviour false positives, all of which, upon inspection, matched developers using the tools exactly as intended. Across the noisiest detection sets, the benign share ranged from 77 % to as high as 99 %, meaning that some rules were wrong on AI‑generated alerts more than four times out of five. The sole exception was the ClickFix detection cluster, which showed a benign rate of only 37 %. This exception proved the rule: ClickFix fires aggressively on agents launched with the permission‑bypass flag, bridging the gap between noise and genuine risk.
From these observations, the first practical step for any SOC is evident: recalibrate the noisiest legacy detections so they no longer treat routine AI agent activity as high‑severity threats. Simultaneously, organizations should establish clear policies governing what data may be shared with third‑party AI platforms—paralleling the oversight applied to any other SaaS service—and then proactively hunt for warning signs such as permission‑bypass flags, unexpected network tunnels, or risky OAuth grants, rather than waiting for an alert to fire.
The second, more challenging step involves reshaping the triage process itself. Because AI tools act on behalf of the user, using the user’s credentials, any resulting alert is attributed to that individual. In the pre‑AI era, unexplained actions on a workstation almost always signaled a compromised host. Today, analysts must first determine whether the observed behaviour originated from the user or from an AI agent operating under the user’s identity. This extra layer of investigation adds time and cognitive load, demanding new playbooks and possibly additional telemetry that can distinguish agent‑initiated actions from genuine user activity.
Isolation offers a pragmatic way to reduce this ambiguity. Running AI assistants inside containers, virtual machines, or dedicated sandbox environments limits their reach to the host system and makes it easier to attribute actions to the agent rather than the user. By restricting access to credential stores, network interfaces, and sensitive files, organizations can contain potential misuse while still gaining the productivity benefits of AI. When combined with strict egress monitoring, such isolation turns a noisy alert source into a manageable, observable component.
Putting the three categories together, the operational reality of enterprise AI adoption is clear: AI has not yet delivered a flood of AI‑powered breaches, but it has generated a growing avalanche of alerts that are overwhelmingly false, obscuring a smaller set of authentic exposures. A security team that treats every agent action as a potential intrusion will burn out on false positives and miss the subtle signals—like an ngrok tunnel or a keychain dump—that truly matter. The path forward is less about detecting novel AI attacks and more about teaching detection engines what normal AI behaviour looks like, a task that will become unavoidable as alert volumes double and triple month after month.
Security platforms that leverage autonomous AI to investigate every alert in real time—applying forensic‑level analysis to endpoints, email, and cloud workloads—can close this gap. By delivering trustworthy verdicts without human intervention for each notification, they allow SOC analysts to focus on the handful of genuine risks and the occasional true threat, rather than drowning in noise. If you are experiencing this shift in your own alert stream, consider exploring solutions like Intezer’s autonomous AI SOC platform, which offers full coverage and actionable insights while preserving analyst capacity. Begin by auditing your current detection rules for AI‑related false positives, implement permission‑bypass harnesses, isolate AI workloads, and establish proactive hunting routines to stay ahead of the curve.