Kaspersky Fortifies Defenses Against Evolving AI Agent Threats
Kaspersky has enhanced its security product suite with new capabilities designed to detect, control, and analyze the risks posed by increasingly prevalent AI agents in corporate environments.
The rapid integration of AI agents and their associated tooling into corporate infrastructure presents a growing security challenge, as these agents can operate with user privileges to access data, execute commands, and interact with external services. Recognizing this evolving threat landscape, Kaspersky has proactively updated its security solutions to provide enhanced detection and control mechanisms for AI agents.
Kaspersky's approach to mitigating AI agent risks is multi-faceted. The Kaspersky Threat Intelligence Portal now features dedicated profiles detailing various AI agents and the methods attackers employ to exploit them. This knowledge base is crucial for security teams to understand the nature of the threats they face. At their core, AI agents are processes running on endpoints, making Endpoint Detection and Response (EDR) solutions a primary line of defense. Kaspersky's EDR capabilities are designed to detect the presence and activity of AI agents, identify potentially malicious behavior, and take decisive action, such as terminating suspicious processes or isolating compromised hosts.
To provide granular control over AI agent usage, Kaspersky Endpoint Security, including the newer Kaspersky Next platform, leverages its Application Control and Web Control components. Application Control categorizes and monitors all application processes launched on endpoints, allowing administrators to enforce policies that permit or block specific AI agents based on KL categories. This provides visibility into which agents are running, on which hosts, and under which accounts, enabling administrators to manage their deployment effectively. For instance, administrators can configure Application Control to block AI tools entirely or allow only specific approved applications.
Complementing Application Control, Web Control manages user access to web resources. If an AI agent attempts to access a prohibited website, Kaspersky's Web Control can block the connection and alert the user. This dual-component strategy ensures that both the execution of AI agents and their network interactions can be managed according to an organization's security policies. The KL categories provide a standardized way to classify software, including AI agents, making it easier for security teams to apply consistent rules across their environment.
Beyond controlling agent execution and network access, Kaspersky also addresses the risk of AI agents themselves containing malicious instructions or downloading unsafe components. The Kaspersky Scan Engine is employed to analyze installed applications for threats and to scrutinize Large Language Model (LLM) files for malicious code. This deep-scan capability is vital for uncovering threats that might be embedded within the AI agent's own code or its downloaded 'skills'.
The popularity of AI agents, particularly those for software development, is evident in Kaspersky's telemetry. Tools from Anthropic and OpenAI, such as Claude and Codex, are among the most frequently detected AI products on endpoints. The data also indicates a significant increase in the number of published vulnerabilities related to LLMs, AI tools, and plugins, with over 2,500 vulnerabilities reported between 2025 and the current year, underscoring the urgent need for robust security measures.
Kaspersky's updated product suite aims to provide a comprehensive defense against the evolving threats posed by AI agents. By combining threat intelligence, advanced endpoint detection, granular application and web control, and in-depth scanning, the company is equipping organizations with the tools necessary to navigate the complexities of AI integration securely and mitigate potential risks before they escalate into significant security incidents.