Malware injection attacks on AI agents are rising and antivirus software has yet to adapt, according to Sergey Lozhkin, head of Kaspersky’s global research and analysis team for Asia-Pacific, the Middle East, Turkey and Africa.
Speaking at a Kaspersky cybersecurity event in Tbilisi, Georgia, on Monday, which TechCentral attended, Lozhkin said AI-driven threats increasingly originate outside an organisation’s network, with application programming interfaces, frameworks, plugins and the agents themselves posing a direct risk.
Signature-based analysis, which looks for direct commands, no longer works, he said. “Right now, if you or your agent opens a skill, it will look absolutely legitimate, like it is doing the work it is required to do. But everything lives in the cloud, so the skill has commands to connect to external resources and read instructions from there.”
Users are duped into downloading AI-related malware in several ways. Some malware presents itself as a legitimate AI platform, mimicking the capabilities users expect, but ships with hidden instructions to send credentials to an external server.
In the first five months of 2026, Kaspersky detected more than 15 000 unique samples disguised as fake ChatGPT, Claude or Gemini clients and agents, alongside campaigns such as the Silver Fox group’s booby-trapped DeepSeek installer, used for espionage.
Another attack vector is the skill itself. As an agent scours the web for the utilities it needs to complete a task, packages masquerading as legitimate code infect the skill with backdoor instructions.
It’s not theoretical
In March, attackers tracked as TeamPCP backdoored LiteLLM, a widely used AI gateway distributed through the Python Package Index, turning it into a multi-stage stealer that harvested credentials, authentication tokens and cloud and crypto keys.
Most non-technical users accept skill updates and plugin downloads without scrutinising the code. IT professionals and cybersecurity specialists are falling into the trap, too. Lozhkin said attackers know trained professionals tend to read code before accepting it, so they use multi-stage attacks that produce legitimate outputs long enough to earn trust or slip through when fatigue sets in.
“I have seen this with myself. I have created tons of agents to execute my daily tasks. We are now reliant on them. We are lazy now because of AI agents and this is only going to get worse in future,” Lozhkin said.
Read: Autonomous AI agents emerge as the next major cybersecurity risk
Organisations are not defenceless. Dmitry Galov, who heads the Russia and CIS unit of Kaspersky’s global research and analysis team, told TechCentral that established tools such as behavioural analysis are key to catching AI malware at the point where malicious code executes.
Another option is to sandbox AI applications, giving them free rein within an isolated environment while limiting and controlling interactions with the wider internet.
“Organisations don’t have to stop employees from using AI because it might be dangerous, but you can put guardrails in place to make sure sensitive data does not go out,” Galov said.
The new attack vectors nonetheless represent a shift in how organisations need to approach security. With malicious code able to sit dormant behind a legitimate-looking skill and activate only once it reaches the cloud, Lozhkin argued that scanning a file once and trusting the result is no longer enough — and that skills and plugins are being published far too fast for the old model to keep up.
Read: US cybersecurity giant invests big in South Africa
“You need to think and implement defensive mechanisms, because the amount of skills grows exponentially, and we are going into a world where we need to figure something out from the perspective of security researchers, antivirus vendors and companies,” he said. “Otherwise, I have some bad news for you.” — © 2026 NewsCentral Media
- The writer travelled to Tbilisi, Georgia as guest of Kaspersky
