When companies deploy AI coding agents and employees sign into consumer AI tools, security operations centers (SOCs) face an explosion of alerts that look alarming but almost never represent actual threats. A new analysis of enterprise security data reveals that while AI-generated alerts are still a small slice of overall SOC activity, they're the fastest-growing category, climbing 685% between February and June 2026. Yet the composition of these alerts tells a starkly different story than the volume suggests.

Why Are AI Alerts Flooding Security Teams?

The surge in AI-related alerts stems from two distinct behaviors happening simultaneously in enterprises. First, developers install coding agents like OpenAI Codex that legitimately spawn shells, read credential stores, open network tunnels, and download packages as part of normal work. To a security detection engine, these activities look indistinguishable from the early stages of a cyberattack. Second, employees grant OAuth consent to third-party AI applications, share information, and paste documents into generative AI tools, which rarely triggers endpoint detection but represents data leaving the building.

Across roughly 16.9 million SOC alerts reviewed in the research, approximately 73,000 (0.43%) were AI-related. While that percentage seems reassuringly small, the growth trajectory tells a different story. Every full month from February through June 2026 showed higher AI-alert volume than the previous month, with acceleration sharpening in May. Security teams that size their AI-alert handling to current volume will be understaffed within a quarter.

What Percentage of AI Alerts Actually Represent Real Threats?

The breakdown of AI-generated alerts reveals a lopsided distribution. Of all AI-related alerts investigated, 94.1% were classified as noise (legitimate activity that tripped detections written before AI agents existed), 5.8% represented genuine security risks (such as a coding agent running with permission safeguards disabled), and only 0.02% were confirmed real attacks.

When these alerts reached automated triage platforms, the system's verdicts showed similar patterns. About 79.8% received a benign verdict, and 81.7% were automatically suppressed without ever reaching a human analyst. Only 5.4% of AI-related alerts were escalated to a human analyst for review.

Notably, none of the real attacks detected in this category were caused by an organization's own AI agent. Every alert flagged as "AI agent running mimikatz," "reverse shell from a coding tool," or "credential theft" resolved to either a developer doing legitimate work or a detection misfiring. A single detection at one customer accounted for 55% of all "critical" verdict alerts flagging a Windows binary (Expand.exe) as lateral-tool-transfer activity. Upon inspection, it was simply a developer's coding agent setting up a shell environment, which is normal for this type of work.

How to Distinguish Real Threats From AI-Generated Noise

• Severity Labels Require Skepticism: High-severity alerts on AI activity should not be taken at face value. A critical verdict does not necessarily indicate an actual threat, as demonstrated by the Expand.exe case where legitimate developer activity triggered the highest alert level.
• Examine the Agent's Purpose: When an alert shows an AI agent running tools typically associated with attacks, investigators must question why the agent was running those tools and whether it was part of legitimate work or an actual compromise.
• Monitor for Brand Impersonation: Real attacks increasingly ride on AI adoption rather than through it. Phishing campaigns now weaponize AI brand names as lures, exploiting the fact that employees expect routine notifications from these products.

The actual threat landscape reveals a different pattern. Across multiple customers, researchers observed malicious emails with AI-themed subject lines featuring major AI companies. One phishing campaign impersonated OpenAI with the subject "OpenAI Partner Summit 2026" but originated from noreply-zoomevents@zoom.us, using legitimate Zoom infrastructure to lend credibility to a fraudulent invitation. Another email used a fake Google Gemini Ads invitation, presenting itself as a business-related workspace invitation but originating from the suspicious domain gemini-advertisers[.]com. A third campaign used Anthropic as bait in a business context, with the email subject "RE: Anthropic Engagement approval & payment," referencing a supposed contract with Anthropic to make a large payment request appear legitimate.

The lesson for any SOC is clear: the cost of AI adoption so far is not breaches. It is a rising tide of alerts that look alarming and almost never are, combined with a small, quiet set of genuine exposures that those alarms tend to bury. Security teams must recalibrate their alert handling strategies to account for the composition of AI-generated activity, not just its volume. As AI tools become more prevalent in enterprise environments, the ability to distinguish signal from noise will determine whether security operations remain effective or become overwhelmed by false positives.