AI Agents Drive 685% SOC Alert Surge, 94% Noise Buries Real Risks

Enterprise AI adoption splits into developer coding agents that spawn shells, read credentials, and open tunnels—mimicking intrusion TTPs—and employee OAuth grants plus document pasting that silently exfiltrate data. Both trigger legacy detections written before agent behaviors existed. The result is a fast-rising alert class that current triage platforms auto-close as benign at high rates while genuine permission misconfigurations remain under-investigated. Procurement records show most organizations added consumer AI tools without updating EDR rules or consent policies, creating the exact pattern observed. Evidence from anonymized enterprise telemetry confirms the monotonic monthly increase and the lopsided classification split. Independent analysis of OAuth audit logs and endpoint telemetry from the same period shows the 5.8% risk bucket consistently maps to disabled safeguards on coding agents and broad scopes on third-party AI apps. These exposures sit beneath the noise volume and receive less analyst attention than pre-AI detections. The operational pattern matches prior shadow-IT waves but accelerates because agents execute at machine speed inside approved developer workflows. Teams that size staffing to current 0.43% volume will face backlog within one quarter unless detection logic is rewritten for agent-specific behaviors. Next quarter will test whether SOC platforms add agent provenance checks or continue treating AI activity as undifferentiated noise.