EN PT-BR
← Voltar ao feed
low

Kaspersky details controls to detect and restrict AI agents, noting AI-generated Armored Likho loaders

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 07:00 · coletado há 6 dias

Kaspersky describes new capabilities across its portfolio to discover, control and monitor AI agents on corporate endpoints, where agents act with user privileges and can access data, run commands and call external services. The post cites telemetry showing tools from Anthropic and OpenAI topping the September 2026 ranking of AI agents among Kaspersky users, and reports more than 2,500 vulnerabilities published in LLMs, AI tools and plugins since 2025. It also reports that in a recent Armored Likho campaign, AI was used to build loader and dropper samples (compiled with NSIS) and new modules for BusySnake Stealer and BusySnake RAT. Kaspersky argues that such activity is still caught by behavioral rules, because the commands executed and process relationships are the same regardless of who wrote the code.

Detalhes técnicos

  • Armored Likho: AI-generated artifacts included icons in scripts and excessive comments on every function. One AI-developed module runs several virtual-environment checks, computes a score, and either runs or exits with code 0. Commands run via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
  • KEDR AI-specific rules: ai_agent_*_access_to_sensitive_file_** (agent access to credentials, tokens, keys); ai_agent_dangerous_execution_mode (auto-approve/YOLO mode or sandbox disabled); suspicious_mcp_server_artifact (MCP server scripts in hidden, temporary or cache directories); llm_api_access_by_unusual_apps (unusual apps contacting external LLM APIs). Tagging-only rules: ai_agent_**_execution and local_ai_model_artifact.
  • ClickFix risk: a legitimate agent can execute a malicious instruction from a document, web page or email. Unsafe actions can also result from a user's innocent instruction.
  • Malicious skills: skills can bring helper scripts, extra programs or embedded commands. Kaspersky Scan Engine scans skills, scripts and LLM files for malicious code.
  • Kaspersky TIP: AI agent profiles (ai_ prefix) map to MITRE ATT&CK, and the Hunt Hub detection-rule repository (added December 2025) exposes detection logic for EDR, NDR and NGFW.

Remediação

  • Use Application Control (KL categories, denylist or allowlist mode) in Kaspersky Endpoint Security to allow or block AI agents per employee group, and Web Control to block AI-as-a-service sites.
  • Monitor agents with EDR and respond by stopping the process or isolating the host.
  • Scan skills and LLM files obtained from external sources before use.
  • Flag agents running in auto-approval mode or with the sandbox disabled.

Linha do tempo

  1. securelist.com ↗ · pub. 26/10/2026 07:00 · coletado 26/10 09:00 primeiro registro

    Kaspersky details controls to detect and restrict AI agents, noting AI-generated Armored Likho loaders

    ler a análise desta fonte

    Kaspersky describes new capabilities across its portfolio to discover, control and monitor AI agents on corporate endpoints, where agents act with user privileges and can access data, run commands and call external services. The post cites telemetry showing tools from Anthropic and OpenAI topping the September 2026 ranking of AI agents among Kaspersky users, and reports more than 2,500 vulnerabilities published in LLMs, AI tools and plugins since 2025. It also reports that in a recent Armored Likho campaign, AI was used to build loader and dropper samples (compiled with NSIS) and new modules for BusySnake Stealer and BusySnake RAT. Kaspersky argues that such activity is still caught by behavioral rules, because the commands executed and process relationships are the same regardless of who wrote the code.

    Technical Details

    • Armored Likho: AI-generated artifacts included icons in scripts and excessive comments on every function. One AI-developed module runs several virtual-environment checks, computes a score, and either runs or exits with code 0. Commands run via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
    • KEDR AI-specific rules: ai_agent_*_access_to_sensitive_file_** (agent access to credentials, tokens, keys); ai_agent_dangerous_execution_mode (auto-approve/YOLO mode or sandbox disabled); suspicious_mcp_server_artifact (MCP server scripts in hidden, temporary or cache directories); llm_api_access_by_unusual_apps (unusual apps contacting external LLM APIs). Tagging-only rules: ai_agent_**_execution and local_ai_model_artifact.
    • ClickFix risk: a legitimate agent can execute a malicious instruction from a document, web page or email. Unsafe actions can also result from a user's innocent instruction.
    • Malicious skills: skills can bring helper scripts, extra programs or embedded commands. Kaspersky Scan Engine scans skills, scripts and LLM files for malicious code.
    • Kaspersky TIP: AI agent profiles (ai_ prefix) map to MITRE ATT&CK, and the Hunt Hub detection-rule repository (added December 2025) exposes detection logic for EDR, NDR and NGFW.

    Remediation

    • Use Application Control (KL categories, denylist or allowlist mode) in Kaspersky Endpoint Security to allow or block AI agents per employee group, and Web Control to block AI-as-a-service sites.
    • Monitor agents with EDR and respond by stopping the process or isolating the host.
    • Scan skills and LLM files obtained from external sources before use.
    • Flag agents running in auto-approval mode or with the sandbox disabled.