Kaspersky Warns of Malware Hidden in AI Agents
Kaspersky warned in 2026 that malware injection attacks targeting AI agents can evade traditional signature-based antivirus checks. At a cybersecurity event in Tbilisi, Sergey Lozhkin described risks from external instructions delivered through APIs, frameworks, plugins, and agent skills. Separate Kaspersky telemetry counted more than 92,000 detections of malware or potentially unwanted applications disguised as AI services from January through early May 2026.
Kaspersky warned that attackers are using AI agents, plugins, and related software as delivery paths for malware that can evade conventional signature-based antivirus detection. Speaking at a Kaspersky cybersecurity event in Tbilisi, Georgia, Sergey Lozhkin, head of the company's Global Research and Analysis Team for Asia-Pacific, the Middle East, Turkey and Africa, described attacks in which apparently legitimate agent skills retrieve instructions or connect to external resources after installation, according to TechCentral.
Lozhkin told TechCentral that the risk increasingly sits outside an organization's network perimeter, including in APIs, frameworks, plugins, and the agents themselves. He argued that signature-based analysis can fail where a skill initially appears legitimate and its externally sourced behavior changes later. The report characterized behavioral security tools as a compensating control, while calling for approaches tailored to AI injection attacks.
Fake agents and poisoned installation paths
Kaspersky's March research documented campaigns that used Google Search ads to direct users seeking AI tools to counterfeit documentation and installation pages. The company reported that pages impersonating tools including Claude Code, OpenClaw, and Doubao instructed visitors to run malicious commands.
According to Kaspersky, macOS targets in these campaigns received the Atomic macOS Stealer, or AMOS, while Windows targets received the Amatera infostealer. Its researchers wrote that one fake Claude Code documentation site used Squarespace, a legitimate website-building platform, a detail Kaspersky said helped the page bypass some anti-phishing filters.
This distribution method matters because the malicious command is presented as part of a normal developer or agent-installation workflow. Kaspersky's account describes a social-engineering attack on the installation path, rather than a compromise of the legitimate Claude Code product or its official documentation.
Detection figures use different measures
Kaspersky's separate press release reported more than 92,000 detections worldwide of malware and potentially unwanted applications disguised as popular AI agents and services from January through the beginning of May 2026. In that telemetry, fake ChatGPT applications accounted for 49% of detected attacks, while Claude and Gemini each represented 18%, Kaspersky reported.
TechCentral separately reported Kaspersky's figure of more than 15,000 unique samples masquerading as ChatGPT, Claude, or Gemini clients and agents over the first five months of 2026. The two figures should not be read as directly comparable: one counts detections or attacks, while the other counts unique samples.
TechCentral also cited the March compromise of LiteLLM, a widely used AI gateway distributed through the Python Package Index, as an example of a supply-chain route that could expose credentials, authentication tokens, cloud keys, and cryptocurrency keys. The report attributed that incident to attackers tracked as TeamPCP.
What security teams can validate
The reported campaigns concentrate on a practical control boundary for teams adopting agent tooling: the provenance of installers, packages, extensions, and instructions copied into shells. Kaspersky's examples show that a familiar brand name and documentation-like interface are not sufficient evidence that a download source is legitimate.
Companies facing comparable threats commonly combine behavior-focused endpoint monitoring with dependency and package controls. Useful checks include verifying official distribution channels, pinning and reviewing dependencies, restricting outbound access from agent runtimes, and monitoring for credential access or unusual connections after a new tool or skill is installed. These are general defensive patterns, not a finding about any specific affected organization.
The reporting leaves open how broadly the specific injection techniques have been exploited in enterprise agent deployments. Kaspersky's telemetry and campaign research nevertheless document a growing overlap between familiar malware distribution tactics, such as search-ad abuse and counterfeit installers, and demand for AI assistants and workflow automation tools.
Key Points
- 1Kaspersky reported AI-branded malware campaigns that use fake documentation and installers, making software provenance a central security control for agent adoption.
- 2Traditional signatures can miss externally retrieved instructions, while behavioral monitoring can detect suspicious post-installation activity and outbound connections.
- 3Kaspersky's 92,000 detection figure and TechCentral's 15,000 sample figure measure different things, so practitioners should avoid treating them as equivalent.
- 4Comparable agent-security programs commonly combine package verification, dependency review, runtime egress controls, and credential-access monitoring.
Scoring Rationale
The report concerns a material attack surface for organizations deploying AI agents, coding assistants, and third-party skills. Its value to practitioners is primarily defensive: it connects established search-ad and package-distribution abuse with agent installation and externally sourced instructions.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
