Kaspersky Bolsters Defenses Against AI Agent Threats

"AI agents and associated tooling are becoming increasingly common in corporate infrastructure," Kaspersky writes — and with that ubiquity comes new, concrete risks for security teams charged with controlling what runs, what communicates, and what executes on company endpoints.

Where AI agents are already used: products, services, and vulnerabilities

Kaspersky’s telemetry identifies a clear concentration of agentic systems among corporate users. In a September 2026 ranking of AI agents by popularity among Kaspersky users, tools from Anthropic and OpenAI dominate the leaderboard: Claude, Claude Code, Codex, OpenCode, Zed, Wispr Flow, LM Studio, ZCode, Chatbox, and Cherry Studio.

The firm’s review of widely used AI services places ChatGPT, Google Gemini, Claude, Grammarly, and DeepSeek among the most broadly deployed in 2026. Alongside adoption, Kaspersky reports a sharp rise in published vulnerabilities: “From 2025 to date, more than 2500 vulnerabilities have been published” in LLMs, AI tools, and plugins with similar functionality.

Application Control and Web Control: blocking AI agents and AIaaS

Kaspersky describes two administrative controls intended to limit agent use within organizations. Application Control categorizes application processes (KL categories) so administrators can see which agents run on which hosts and under which accounts, and for how long. In Kaspersky Endpoint Security (KES), Application Control supports two modes: Denylist (the default, where any app may run unless blocked) and Allowlist (where only explicitly allowed apps may run).

When configured to block the AI Tools category, KES notifies users and prevents the agent from starting; Web Control can likewise block access to websites that provide AI as a service and show a warning to the user. The product suite Kaspersky Next (the new name for Kaspersky Endpoint Security in some offerings) is cited as an available option for controlling and restricting AI agent launches.

Kaspersky EDR (KEDR): behavioral and AI-specific detection rules

Kaspersky treats an AI agent as a process — one with child processes and network communications that must be monitored. Its Endpoint Detection and Response (KEDR) uses conventional behavioral rules plus a set of rules adapted specifically to detect risky agent actions and configurations.

Examples of AI-focused detection logic include rules named ai_agent_*_access_to_sensitive_file_**, which alert when a named agent accesses files holding credentials, tokens, or keys; ai_agent_dangerous_execution_mode, which flags agents launched with automatic approval of all actions (so-called YOLO mode) or with sandboxing disabled; and suspicious_mcp_server_artifact, which triggers on MCP server scripts created or modified in hidden, temporary, or cache directories.

KEDR also raises alerts with llm_api_access_by_unusual_apps when an application on Windows, Linux, or macOS connects to the API of a known external LLM service outside predefined exclusions. Other rules simply tag events for investigation — for example, ai_agent_**_execution rules flag launches of known agents, and local_ai_model_artifact records creation or modification of model files in typical application, runtime, and cache directories.

The firm illustrates how conventional detections still apply even when AI is used to prepare malicious code. In a recent Armored Likho campaign, Kaspersky found artifacts consistent with AI-generated loaders and droppers — but the attack was detected by standard rules such as shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning when those components executed on endpoints.

Kaspersky Threat Intelligence Portal and Hunt Hub: agent profiles and detection logic

The Kaspersky Threat Intelligence Portal (TIP) hosts software profiles, including AI agent profiles accessible by an ai_ prefix. A profile such as Claude Desktop lists a detailed description of the software, required privilege level, supported platforms, and threat actor groups known to use it. It also maps tactics and techniques to the MITRE ATT&CK framework and enumerates detection paths via Windows audit logs and Sysmon, Linux syscall audit events and Sysmon, and network auditing.

In December 2025 Kaspersky added Hunt Hub to TIP — a repository of detection rules that exposes detection logic for EDR, NDR, and NGFW products. Each rule card in Hunt Hub provides a description, severity and confidence levels, alert format, detection tips, possible false positives, supported platforms, linked tactics and techniques, associated groups, and the exact detection logic that triggers the rule.

Kaspersky Scan Engine: scanning skills and LLM files for embedded malware

Kaspersky emphasizes that agent “skills” — prewritten sets of natural-language instructions that extend agent functionality — can carry malicious instructions, helper scripts, or require additional programs and services. To prevent malicious code from entering systems via skills, Kaspersky Scan Engine can be integrated to analyze skills, associated scripts, and files produced by running agents.

Trained LLM files may come in formats such as PTH, PT, PKL, KERS and others, which can contain parameters, weights, or training datasets. Kaspersky reports that its Scan Engine can deserialize and analyze potentially dangerous LLM formats to detect malicious code, “regardless of model size.”

What this means for security teams, administrators, and developers

• Security teams and SOCs: KEDR can log suspect agent behavior, notify the SOC, and take response actions such as stopping a process or isolating a host; specialized rules help connect suspicious actions back to named agents and execution modes.
• Administrators and KSC operators: Application Control and Web Control provide configurable KL categories and enforcement modes (Denylist or Allowlist) so administrators can block AI tools or AIaaS sites and receive user-facing notifications when launches or web access are denied.
• Developers and AI tool maintainers: Because skills and model files can contain executable components or embedded code, integrating a scanning engine that can deserialize model formats and examine scripts is presented as a necessary control to prevent malicious content from being used operationally.

Kaspersky’s conclusion is direct and specific: organizations can adopt AI agents while minimizing risk by combining intelligence, detection, application control, web filtering, and file-scanning capabilities. When those tools are used together — TIP and Hunt Hub for context and rules, KEDR for monitoring and response, Application and Web Control for policy enforcement, and Scan Engine for skills and model scanning — the vendor argues companies can gain the benefits of agents “in an informed way: with an understanding of the associated risks and effective means of minimizing them.”

Read the original Kaspersky post: https://securelist.com/tr/how-to-secure-ai-agents/121444/