Kaspersky details AI agent detection and control capabilities for corporate endpoints

1. Executive summary

Kaspersky published a product-capability note describing how its endpoint, EDR, threat-intelligence and scanning products detect and restrict AI agents on corporate endpoints. The note is vendor documentation, not a report of an active campaign against a named victim. It carries no CVE, no CVSS score, no CISA KEV entry and no MITRE ATT&CK actor profile, so no severity rating or exploitation state can be assigned from it. The risk it describes is real for EMEA financial services: staff-installed agents such as Claude Code, Codex and OpenCode run with the user's privileges, can execute commands and reach external services, and can be steered by malicious "skills" or by ClickFix-style instructions. The note also cites one concrete campaign, Armored Likho, where Kaspersky says AI was used to generate loader and stealer code; that claim is single-sourced and unconfirmed.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

This item is a vendor capability description, not an incident report. There is no confirmed attack chain to number. What follows is the mechanism Kaspersky describes for how AI agents become an exposure, and the controls it says address it.

Kaspersky's framing is that an AI agent is an ordinary OS process. It has an executable, a child-process tree and network communications, and it runs with the privileges of the user who launched it. That means it can access data, run commands and interact with external services under that account. The exposure is not a software flaw in the agent; it is the agent acting on instructions, whether from the user or from an untrusted source.

Three abuse paths are described. First, an attacker uses an installed agent as an automation tool, letting it choose and run commands within its privileges. Second, a legitimate agent is used in a ClickFix attack, where it executes a malicious instruction received from a document, web page or email. Third, a harmless agent is extended with a malicious skill: a prewritten set of natural-language instructions that can require additional programs and services, ship helper scripts (Python is named), or carry a malicious command embedded in the instruction text itself. Kaspersky notes that unsafe agent actions do not always indicate an attack; an incident can follow an ordinary instruction from a user who did not understand the consequence. The mere launch of an agent does not reveal whether it is part of an attack.

Kaspersky's September 2026 telemetry ranking of AI applications among its users puts Claude first, Claude Code second, Codex third, OpenCode fourth and Zed fifth, followed by Wispr Flow, LM Studio, ZCode, Chatbox and Cherry Studio. The ranking counts users with the vendor's product installed at the time of the study; it is Kaspersky telemetry, not a market survey. The note states that more than 2,500 vulnerabilities in LLMs, AI tools and plugins with similar functionality were published from 2025 to date, without naming any of them.

The controls Kaspersky describes map to specific product components. Application Control in Kaspersky Endpoint Security (also sold as Kaspersky Next) classifies launched processes by KL category, including an AI Tools category, and can allow or block agents per employee group from Kaspersky Security Center. It records which agents run, on which hosts, under which accounts, and for how long. Web Control blocks access to web-resource categories, including AI-as-a-service sites. Kaspersky EDR (KEDR) applies conventional behavioural rules plus AI-specific rules. The AI-specific rules named in the note are:

• ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** the OS: alerts when an agent reads files holding credentials, tokens or keys.
• ai_agent_dangerous_execution_mode: detects agents started with auto-approval of all actions (YOLO mode) or with the sandbox disabled.
• suspicious_mcp_server_artifact: fires when MCP server scripts are created or modified in hidden, temporary or cache directories, a placement Kaspersky says attackers use to connect an MCP server to an agent quietly and pass it instructions, call third-party tools or reach user data.
• llm_api_access_by_unusual_apps: alerts when an application on Windows, Linux or macOS connects to a known external LLM service API outside predefined exclusions.
• ai_agent_**_execution and local_ai_model_artifact: tag events for investigation without alerting; the second records creation or modification of AI model files in typical application, runtime and cache directories, which surfaces agents running local models that never call an external API.

Kaspersky Scan Engine is positioned to scan agent skills, their helper scripts and files generated by running agents for malicious code.

The one campaign named is Armored Likho. Kaspersky says it found signs that AI was used to create loader and dropper samples compiled with NSIS (Nullsoft Scriptable Install System), with icons in the scripts and excessive comments on every function as the telltale artefacts. It says the group continues to generate modules for BusySnake Stealer and BusySnake RAT, including a module that runs multiple checks for virtual-environment artefacts, calculates a score, and either runs the sample or exits with code 0. Kaspersky states the commands these samples execute via rundll32 and PowerShell are caught by its shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules. This is a single-source vendor claim. No hashes, C2 addresses, file paths or build artefacts are given, no MITRE ATT&CK profile for Armored Likho is supplied, and the attribution and the AI-generation assessment are unconfirmed. Treat the campaign detail as context for detection logic, not as an indicator set.

4. Mitigation & containment

P1 (within 24h)

• Inventory AI agents already running on endpoints. If Kaspersky Endpoint Security is deployed, use Application Control's KL AI Tools category to list which agents run, on which hosts, under which accounts and for how long. Without Kaspersky, pull process telemetry for the executables behind Claude, Claude Code, Codex, OpenCode, Zed, LM Studio, Chatbox and Cherry Studio.
• Hunt for agents started in YOLO mode or with the sandbox disabled. These settings let an agent act without user confirmation and are the condition Kaspersky's ai_agent_dangerous_execution_mode rule targets.
• Hunt for MCP server scripts created or modified in hidden, temporary or cache directories, the placement behind suspicious_mcp_server_artifact. Any such script connected to an agent should be reviewed before the agent is used again.

P2 (within 72h)

• Decide an allow/block policy per employee group for AI agents and enforce it. In KES, configure Application Control for the AI Tools category in block mode so a launch attempt is refused and the user sees a notification. Where agents are approved, restrict them to the groups that need them.
• Block AI-as-a-service web categories through Web Control for groups with no approved use.
• Scan installed agent skills and their helper scripts with an AV or scanning engine before use, and rescan on any skill update. Skills from external sources are the entry path Kaspersky describes for embedded malicious commands and Python helper scripts.

P3 (within 7 days)

• Alert on applications connecting to known external LLM service APIs outside an approved list (llm_api_access_by_unusual_apps behaviour), and baseline which applications legitimately call those APIs.
• Enable event tagging for known agent launches and local AI model file creation in application, runtime and cache directories, so agents running local models are visible even with no external API traffic.
• Keep conventional behavioural detections tuned for the post-agent actions: suspicious PowerShell launch, Task Scheduler persistence, credential access. Kaspersky's position is that these traces look the same regardless of what initiated them, so existing rules carry most of the detection weight.

5. Indicators of compromise

No indicators of compromise available in the source material. The note gives no hashes, domains, IP addresses, file paths or registry keys. The rule names and process behaviours it describes are detection logic, not atomic indicators, and are covered in §6.

6. Detection

The source gives no file artefacts, hashes or command-line strings from a malicious sample. The usable material is behavioural: agent processes reading credential files, agents launched in auto-approval or sandbox-disabled mode, MCP server scripts written to hidden or cache directories, and unusual applications calling LLM APIs. A Sigma rule can express the process and file-creation behaviours; a YARA rule cannot be built without file artefacts, and none are present.

title: AI agent launched in auto-approval or sandbox-disabled mode
id: 8f3c2a71-4d6e-4b19-9a2f-6c1e7d5b0a44
status: experimental
description: Detects AI agent processes started with flags that disable confirmation or the sandbox (YOLO mode), per Kaspersky ai_agent_dangerous_execution_mode behaviour. Command-line flags vary by agent; tune the selection to the agents approved in your estate.
author: Adverse Trace
date: 2026-10-26
references:

  - https://securelist.com/tr/how-to-secure-ai-agents/121444/
logsource:
  category: process_creation
  product: windows
detection:
  selection_agent:
    Image|endswith:

      - '\claude.exe'
      - '\codex.exe'
      - '\opencode.exe'
  selection_flags:
    CommandLine|contains:

      - '--dangerously-skip-permissions'
      - '--yolo'
      - '--no-sandbox'
      - '--auto-approve'
  condition: selection_agent and selection_flags
falsepositives:

  - Developer workstations where an agent is deliberately run unattended; require a documented exception
level: medium

title: MCP server script created in hidden or cache directory
id: 2b9e6c04-7a1d-4f83-b5e2-9d0c3a8f1e67
status: experimental
description: Detects creation of MCP server scripts in hidden, temporary or cache directories, the placement Kaspersky associates with suspicious_mcp_server_artifact.
author: Adverse Trace
date: 2026-10-26
references:

  - https://securelist.com/tr/how-to-secure-ai-agents/121444/
logsource:
  category: file_event
  product: windows
detection:
  selection_name:
    TargetFilename|endswith:

      - '\mcp-server.js'
      - '\mcp_server.py'
      - '\mcp-server.py'
  selection_path:
    TargetFilename|contains:

      - '\AppData\Local\Temp\'
      - '\.cache\'
      - '\.config\'
  condition: selection_name and selection_path
falsepositives:

  - Legitimate MCP server installs by developers; baseline approved paths
level: medium

7. Sources

• Kaspersky Securelist, "Deploying AI agents securely: how Kaspersky products mitigate AI threats", https://securelist.com/tr/how-to-secure-ai-agents/121444/, 2026-10-26.

8. Adverse Trace position

Adverse Trace assesses this as a vendor capability note with no assigned severity: there is no CVE, no CVSS score, no CISA KEV entry and no MITRE ATT&CK actor profile in the record, and the Armored Likho detail is a single-source Kaspersky claim that we have not corroborated. The client impact is indirect but concrete. AI agents are already on EMEA financial services endpoints, they run with user privileges, and the controls that make them visible and restrictable are configuration decisions most firms have not made. We will track Kaspersky's AI-specific rule set and the Armored Likho reporting for corroborating technical detail, and we will reissue if a named campaign, CVE or indicator set emerges that changes the severity. Clients running Kaspersky Endpoint Security should confirm whether the AI Tools category is enforced or merely monitored, and report back which agents are present in their estate.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.