We analyze an escape in XProtect behavior events abused during the current XCSSET malware campaign, then we explain why XProtect behavioral telemetry is flawed by design.