AI is moving from tools that generate content to systems capable of planning tasks, using software tools, calling APIs, and acting with increasing autonomy. But as businesses prioritize productivity, Kaspersky researchers warn that the speed of AI adoption is creating another problem: users may be trusting AI-driven systems faster than they can verify them.
Sojun Ryu, security researcher at Kaspersky’s Global Research and Analysis Team (GReAT), said the shift toward AI agents has increased the consequences of skipping verification.
When AI systems can act autonomously, a compromised tool, application, or software component can potentially turn that trust into an attack path.
Fake AI applications are already targeting users
Kaspersky GReAT researchers identified 92,000 malicious attacks in 2026 disguised as AI services. Nearly half, or 49%, posed as ChatGPT applications, while Claude and Gemini each accounted for 18% of the detected attacks.
The problem goes beyond fake consumer applications. Researchers also identified more than 15,000 malware samples disguised as agentic AI software, including trojans, spyware, exploits, downloaders, droppers, and backdoors.
Running one of these applications could give attackers opportunities to steal internal information or establish command-and-control access.
For organizations adopting AI agents into development and other workflows, that makes software verification increasingly important. A tool that appears legitimate can become a security problem if its origin and behavior are not properly checked.
Open-source software adds another layer of risk
AI development also depends heavily on open-source software, creating another area where attackers can exploit existing trust.
Ryu pointed to recent campaigns targeting ecosystems such as npm and PyPI, including attacks involving widely used packages and self-propagating malware such as Shai-Hulud.
One example came in March 2026, when attackers compromised the maintainer’s computer for Axios, a widely used JavaScript library, and gained access to its npm account. Malicious versions of the package were subsequently published.
Axios is downloaded more than 100 million times per week and is used by more than 170,000 software packages, according to Kaspersky.
Although the compromised versions were available for only around three hours, hundreds of devices downloaded them during that period. The incident showed how quickly a compromise involving a trusted software component can move through the supply chain.
Kaspersky also cited its survey finding that 31% of enterprise businesses had experienced a supply chain attack during the previous year.
Security needs to keep pace with AI-driven productivity
Rather than slowing AI adoption with additional approval processes, Ryu recommends designing development environments where the secure path is also the easiest path to follow.
That starts with establishing clear boundaries between external content and internal development assets. Organizations should also secure their integrated development environments (IDEs), extensions, workspaces, and AI agent permissions.
Visibility is another key requirement. Companies need to control how software enters their environments and maintain an overview of activity across development workflows.
The goal, according to Ryu, is not to add more friction to every task, but to ensure that developers can work productively without treating unverified software and AI-generated actions as inherently trustworthy.
Securing the environment where software is created
Kaspersky said its GReAT researchers monitor open-source software and provide feeds that flag vulnerable or malicious components.
The company has also audited GitHub Actions workflows using Kaspersky Container Security and identified more than 250,000 potential misconfigurations in CI/CD environments.
Those findings point to a broader issue facing organizations adopting AI into software development. Security cannot focus exclusively on the applications and systems deployed at the end of the development process; the environments and tools used to create them can also become attack targets.
As AI agents gain more access to development tools and enterprise systems, verification becomes a critical part of keeping that autonomy useful rather than dangerous.
For businesses, the challenge is therefore not simply deciding how much AI to use, but determining what AI systems, software components, and actions can actually be trusted—and how that trust is verified before execution.
