Approving an AI coding assistant or remote-management agent settles which software may run. It does not establish that every command, connection or session using that software is authorized. That distinction matters when legitimate tools become part of an intrusion.
Elastic’s November 2026 threats, etc report describes abuse of trusted AI applications and remote monitoring and management (RMM) software. The edition covers observations from April 4 through September 8, 2026; it is retrospective research, rather than an announcement of a newly discovered incident.
The report includes two August intrusions involving AI clients as execution parents or command proxies. Its RMM section records 23 confirmed findings between June 15 and August 12, with ScreenConnect the most frequently named product.
Those findings are not 23 victims. Elastic says multiple findings may share a host or tenant, and its voluntarily supplied telemetry is neither a global activity census nor a measure of detection effectiveness.
Reconstruct the authorized session
There is an important qualification in Elastic’s separate August 7 coding-agent case study. A macOS sequence involving credentialed web requests, reverse tunnels and LaunchAgents could describe administration of a locally hosted application. The authors kept the serious alerts while declining to classify every dual-use action as confirmed malware. Process ancestry helps reconstruct a session; it does not, by itself, settle intent.
The broader mechanism is independently documented in MITRE ATT&CK’s Remote Access Tools technique, T1219. Legitimate remote-access products can provide interactive command and control, and their installation can create persistence through services. MITRE’s detection approach follows a sequence: agent execution, persistence, sustained external communication and interactive child processes. Its mitigations include restricting unapproved remote-access software and unnecessary remote functionality, alongside controls on outbound traffic.
For an operations team, that supports a concrete review: identify the approved tool and its owner, verify the remote destination, then connect the session to its commands and persistence changes. An unfamiliar session warrants investigation even when the executable has a familiar vendor name.
Our reading is that software approval belongs among the evidence an analyst evaluates. Ask who initiated the activity, what access they were authorized to use, and whether the observed outcome matches that purpose.
