Sophos ran a week of endpoint telemetry on Claude Code, Cursor, and Codex. 56.2% of blocking hits were credential access. The agents were working correctly.
