AI-related security alerts surged 685% between February and June 2026, even as they still represent just 0.43% of all alerts reaching enterprise security operations centers, according to a new study published by Intezer, an autonomous AI SOC platform. The research examined roughly 16.9 million SOC alerts and found that while AI tools account for a tiny fraction of today's alert volume, they're expanding faster than any other category. The report concludes that the real cost of enterprise AI adoption isn't breaches—it's a flood of alarms that look serious but almost never are, alongside a smaller set of genuine risks those alarms tend to obscure.
Of the approximately 73,000 AI-related alerts investigators reviewed, 94.1% turned out to be noise—legitimate activity that triggered detections written before AI agents existed. Another 5.8% represented genuine security risks, such as coding agents running with permission safeguards disabled or employees granting OAuth access to third-party AI applications. Real attacks accounted for just 0.02% of the total. Growth has been relentless: every full month from February through June 2026 produced more AI-related alerts than the one before, with the pace accelerating sharply in May. When alerts reached automated triage platforms, 79.8% received a benign verdict, and 81.7% were automatically suppressed without ever reaching a human analyst. Only 5.4% of AI-related alerts were escalated to a person. At one customer, a single detection flagging a Windows binary as a lateral-tool-transfer accounted for 55% of all critical-severity alerts; upon inspection, it was simply a developer's coding agent setting up a shell environment.
The study identifies two distinct behaviors driving the alert surge. Developers install coding agents that spawn shells, read credential stores, open network tunnels, and run security tooling—all legitimate work, but indistinguishable to detection engines from the early stages of an intrusion. Meanwhile, employees grant OAuth consent to third-party AI apps and paste documents into generative-AI tools, activity that rarely trips endpoint detection but represents the moment corporate data leaves the building. According to the report, "the closer we looked, the more the 'attack' dissolved into context." The confirmed attacks investigators found didn't come from organizations' own agents—they were phishing campaigns that weaponized AI brand names as lures, exploiting the fact that employees now expect email from these products. Examples included fake Anthropic invoices, fraudulent Gemini Ads invitations, and spoofed OpenAI Partner Summit registrations.
The breakdown reveals why security teams struggle. Nearly all the noise stems from legitimate AI vendor software triggering major EDR rules: the genuine Anthropic Claude Desktop installer, verified by its code signature, set off "Ransomware Operations detected" and "Encoded PowerShell Download and Run" alerts across several customers. Developers using tools as intended triggered "PowerShell created possible reverse TCP shell" detections and ClickFix alarms. Across the noisiest AI activity detections, the benign share ranged from 77% to 99%. The report warns that "a team that sizes its AI-alert handling to current volume will be under-provisioned within a quarter," treating the 0.43% figure as today's floor, not a ceiling. The 5.8% classified as genuine risk—agents running with permission-bypass flags, unauthorized tunnels, risky OAuth grants—represents standing exposure that alerting largely misses, buried under the false positives.
The study recommends security teams first tune legacy detections that fire at high severity on routine agent work, then proactively hunt for permission-bypass flags and risky OAuth grants rather than wait for alerts. It suggests running AI tools in isolated environments like Docker containers or virtual machines to separate the agent's context from the user's and restrict access to credentials. The report concludes that "a SOC that treats every agent action as a potential intrusion will exhaust itself on false positives and, in doing so, will be less likely to notice the ngrok tunnel or the keychain dump that actually matters." The work ahead is less about detecting AI attacks and more about teaching detection engines what normal AI behavior looks like before monthly volume that's doubling and tripling makes that work unavoidable. Organizations that master this distinction will scale with AI adoption; those that don't risk drowning in alerts that mean nothing while missing the exposures that do. The triage challenge has fundamentally shifted: suspicious activity once indicated compromise, but now teams must first determine whether an AI agent executed the action—a layer of complexity that legacy security architectures weren't built to handle.