/
← Voltar ao feed
medium small and medium businesses

ESET: SMBs face AI agent supply chain and prompt injection risks alongside accelerated phishing, exploitation and ransomware

1 fonte(s) · 1 atualização(ões) · publicado 21/09/2026 06:00 · coletado há 2 dias

ESET analysis describes a two-pronged risk for small and mid-size businesses (SMBs): AI agents create new paths into business systems, while attackers use AI to add speed and scale to established threats. Between March and May 2026, ESET scanned almost 900,000 unique agent skills from popular repositories and found more than 25,000 suspicious and more than 3,000 outright malicious, leading to credential theft, data exfiltration and remote code execution. ESET's survey of 4,400 SMB decision-makers found 40% had no AI policy. Phishing and exploitation of known vulnerabilities remain the top breach causes, and nearly a quarter of almost 500 known exploited vulnerabilities in H1 2026 were exploited on or before disclosure day. The article recommends visibility over agents, limiting the "lethal trifecta" and using MDR services.

Detalhes técnicos

  • Agent supply chain: Skills and MCP server connections stay live dependencies, so a tool can later change into an infostealer ("rug pull"). The skills ecosystem lacks app-store-style gatekeeping.
  • Prompt injection: LLMs cannot reliably separate trusted instructions from untrusted data. Indirect prompt injection is the most common threat, and the EchoLeak vulnerability in Microsoft 365 Copilot showed data exposure without a link click. A red-teaming competition found a successful hijack against all 13 frontier models tested.
  • Other AI-specific vectors: Hallucinated library names and domains that attackers register (slopsquatting-style), poisoning of agent long-term memory, and agentic misalignment.
  • Classic threats: Microsoft reports a 54% click-through rate for AI-automated phishing versus 12% for standard attempts. QR code phishing is rising. ClickFix lures are now disguised as AI troubleshooting and abuse public sharing features of AI services. Phishing-as-a-service kits capture logins.
  • Ransomware and EDR evasion: Ransomware is run at higher volume for lower returns. ESET has documented more than 100 EDR-killer tools, mostly abusing vulnerable drivers.
  • AI in malware: ESET documented PromptLock (first known AI-powered ransomware, proof of concept) and PromptSpy (first known Android malware abusing generative AI in its execution flow). AI's main contribution remains human-led acceleration.

Remediação

  • Inventory the agents and AI services running, who connected them and what permissions they hold.
  • Remove at least one leg of the "lethal trifecta": access to sensitive data, exposure to external content, and ability to communicate or act externally.
  • Apply task- and time-specific boundaries and oversight to agents, and continuously monitor skills and MCP dependencies rather than relying on a one-off review.
  • Adopt an AI policy and address shadow AI.
  • Use an MDR service that monitors agent inputs, tools and actions, and detects post-compromise activity such as suspicious commands, lateral movement, data theft and ransomware deployment.

Linha do tempo

  1. welivesecurity.com ↗ · pub. 21/09/2026 06:00 · coletado 19/10 18:00 primeiro registro

    ESET: SMBs face AI agent supply chain and prompt injection risks alongside accelerated phishing, exploitation and ransomware

    ler a análise desta fonte

    ESET analysis describes a two-pronged risk for small and mid-size businesses (SMBs): AI agents create new paths into business systems, while attackers use AI to add speed and scale to established threats. Between March and May 2026, ESET scanned almost 900,000 unique agent skills from popular repositories and found more than 25,000 suspicious and more than 3,000 outright malicious, leading to credential theft, data exfiltration and remote code execution. ESET's survey of 4,400 SMB decision-makers found 40% had no AI policy. Phishing and exploitation of known vulnerabilities remain the top breach causes, and nearly a quarter of almost 500 known exploited vulnerabilities in H1 2026 were exploited on or before disclosure day. The article recommends visibility over agents, limiting the "lethal trifecta" and using MDR services.

    Technical Details

    • Agent supply chain: Skills and MCP server connections stay live dependencies, so a tool can later change into an infostealer ("rug pull"). The skills ecosystem lacks app-store-style gatekeeping.
    • Prompt injection: LLMs cannot reliably separate trusted instructions from untrusted data. Indirect prompt injection is the most common threat, and the EchoLeak vulnerability in Microsoft 365 Copilot showed data exposure without a link click. A red-teaming competition found a successful hijack against all 13 frontier models tested.
    • Other AI-specific vectors: Hallucinated library names and domains that attackers register (slopsquatting-style), poisoning of agent long-term memory, and agentic misalignment.
    • Classic threats: Microsoft reports a 54% click-through rate for AI-automated phishing versus 12% for standard attempts. QR code phishing is rising. ClickFix lures are now disguised as AI troubleshooting and abuse public sharing features of AI services. Phishing-as-a-service kits capture logins.
    • Ransomware and EDR evasion: Ransomware is run at higher volume for lower returns. ESET has documented more than 100 EDR-killer tools, mostly abusing vulnerable drivers.
    • AI in malware: ESET documented PromptLock (first known AI-powered ransomware, proof of concept) and PromptSpy (first known Android malware abusing generative AI in its execution flow). AI's main contribution remains human-led acceleration.

    Remediation

    • Inventory the agents and AI services running, who connected them and what permissions they hold.
    • Remove at least one leg of the "lethal trifecta": access to sensitive data, exposure to external content, and ability to communicate or act externally.
    • Apply task- and time-specific boundaries and oversight to agents, and continuously monitor skills and MCP dependencies rather than relying on a one-off review.
    • Adopt an AI policy and address shadow AI.
    • Use an MDR service that monitors agent inputs, tools and actions, and detects post-compromise activity such as suspicious commands, lateral movement, data theft and ransomware deployment.