Kaspersky Launches Malware Detection for AI Agents, Models, and Skills

This page was machine-translated and may differ from the original. View original

Kaspersky Launches Malware Detection for AI Agents, Models, and Skills

Published2026.08.18 11:25

Over 15,000 Agentic AI-Disguised Malware Samples Confirmed This Year

As AI agent adoption rapidly expands in enterprise environments, supply chain security threats mediated through external frameworks, APIs, and plugins are emerging as a new challenge. In response, Kaspersky has disclosed a capability to inspect AI components themselves.

Kaspersky (Branch Manager Lee Hyo-eun) announced on the 18th that it will provide malware and backdoor inspection capabilities targeting AI agents, AI models, and "agent skills" that extend functionality to perform specific tasks. The company explained that this capability expands the existing software supply chain security domain into the AI stack, with the aim of enabling employees to proactively identify security risks before introducing AI components into the enterprise environment.

Pre-Inspection System Prior to AI Agent, Model, and Skill Deployment

The capability operates at the infrastructure and supply chain layer within endpoint and threat intelligence products. Inspections are performed both at the point of downloading OpenClaw skills and at the point of actual implementation. Inspection targets include △AI agents △AI models △downloadable agent skills. Kaspersky stated that it can detect malware, backdoors, and bias. Over 15,000 malware samples disguised as agentic AI software have been confirmed this year, and from January 2026 through early May, over 92,000 attacks of malware and unwanted applications impersonating AI agents and services were detected. Among these, fake ChatGPT applications accounted for 49%, while Claude and Gemini each comprised 18%.

Increase in AI-Exploited Attacks and Long-Term Dormancy Cases Confirmed

Kaspersky blocked an average of 500,000 unique malicious files per day last year, a 7% increase compared to the previous year. Attackers generating malware variants using AI was cited as one of the contributing factors to the increase. In 31% of analyzed incidents, malicious activity persisted for over three months, and 52% of high-risk breach cases were only discovered after 90 days. Kaspersky's Global Research & Analysis Team (GReAT) is tracking over 900 attack activities and groups. The Kimsuky APT group, which has been active targeting South Korean government agencies, was confirmed to have exploited Visual Studio Code tunneling, and Kaspersky reported that code traces presumed to be generated by large language models (LLMs) were also discovered in the group's malware.

#AI 에이전트 #사이버 위협 #공급망 보안 #Kaspersky #악성코드 탐지 #AI 모델 검증 #백도어 #LLM 보안

본 기사에 대한 정정·반론·추후보도 청구는 보도 청구 안내를, 그간 게재된 보도문은 정정·반론보도 모아보기를 참고해 주세요.

명세환 기자

All articles by this reporter

관련뉴스

Kaspersky Confirms 'SparkCat' Variant Bypassing App Store and Google Play

Kaspersky has announced that it has identified a new variant of 'SparkCat,' a cryptocurrency theft malware distributed through official app stores. The malware disguises itself as a legitimate application to access the photo gallery on users' devices, then utilizes OCR technology to analyze text within images and search for wallet recovery phrases. A notable characteristic is that Android-based searches focus on Asian language keywords, while iOS-based searches center on English language keywords. Although some infected apps have already been removed, distribution through third-party channels has also been confirmed. Security experts have analyzed that cases of bypassing official store review processes are increasing as advanced techniques such as obfuscation and code virtualization are being applied.

2026.04.27by 배종인 기자

Kaspersky Releases Report on Linux Kernel Vulnerability 'Copy Fail'

Kaspersky disclosed a Linux kernel vulnerability called 'Copy Fail,' revealing that root privilege escalation is possible through memory cache manipulation alone without file modification. Since the vulnerability operates by leveraging normal system calls, it is difficult to detect with conventional endpoint security solutions. While kernel updates are the fundamental mitigation measure, in environments where immediate patching is impractical, monitoring for abnormal privilege escalation indicators through behavioral analysis based on EDR and SIEM is necessary.

2026.05.07by 배종인 기자

Kaspersky Joins DCO… First Cybersecurity Company to Participate

Kaspersky has joined the Digital Cooperation Organization (DCO) as an observer. As the first cybersecurity company to participate in the DCO, it plans to share cyber threat response experience and capacity-building programs with member states and organizations. This participation demonstrates that digital economy discussions are expanding beyond technology accessibility to encompass security and resilience.

2026.05.28by 명세환 기자

Kaspersky Detects 'SilverFox' APT Disguised as Tax Notices

Kaspersky has detected an APT attack called "SilverFox" that distributes malicious files by impersonating tax authority tax violation notices. According to GReAT analysis, over 1,600 malicious emails targeting industrial, consulting, trade, and transportation companies in India, Indonesia, South Africa, and Russia were identified in January and February alone. The attackers deployed ValleyRAT, a Python-based backdoor ABCDoor, and a new RustSL variant to attempt remote control and sensitive data exfiltration. Kaspersky noted that South Korea is also vulnerable to impersonation phishing due to its high dependence on e-government and tax systems, and recommended enhancing employee security awareness training and EDR capabilities.

2026.06.23by 명세환 기자

Kaspersky: “Companies Expand Their Security Boundaries to Partners”

According to a supply chain security investment analysis report released by Kaspersky, over 69% of enterprises are willing to invest in supplier security, and 25% are already implementing shared security cost arrangements. As supply chain attacks compromise one-third of global enterprises, companies are shifting their strategy to expand security perimeters from internal operations to their entire ecosystem.

2026.06.25by 명세환 기자