--- title: How Kaspersky solutions protect against AI threats description: Kaspersky describes new detection capabilities built into its products to counter threats from AI agents in corporate environments. The Threat Intelligence... canonical: https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Kaspersky solutions protect against AI threats | daily.dev og:description: Kaspersky describes new detection capabilities built into its products to counter threats from AI agents in corporate environments. The Threat Intelligence... og:url: https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d og:image: https://api.daily.dev/og/posts/dgaah8I4d.png og:image:alt: How Kaspersky solutions protect against AI threats og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Kaspersky solutions protect against AI threats **[Securelist](https://daily.dev/sources/securelist)** · 13 min read · 1 upvotes · 0 comments ## Summary Kaspersky describes new detection capabilities built into its products to counter threats from AI agents in corporate environments. The Threat Intelligence Portal now includes AI agent profiles and, since December 2025, a Hunt Hub repository of detection rules mapped to MITRE ATT&CK. Kaspersky EDR adds specialized rules like ai_agent_dangerous_execution_mode, which flags agents run with auto-approval (YOLO mode) or disabled sandboxing, and suspicious_mcp_server_artifact, which catches MCP server scripts hidden in temp or cache folders. Application Control and Web Control can block AI tools by category, and Scan Engine checks agent skills and LLM files for malicious code. More than 2,500 vulnerabilities in AI tools and plugins have been published since 2025, and Claude and Claude Code top Kaspersky's September 2026 popularity ranking among users. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I detect when an AI coding agent is running with auto-approval or sandbox disabled on an endpoint? A dedicated EDR detection rule called ai_agent_dangerous_execution_mode flags agents launched with auto-approval of all actions, known as YOLO mode, or with the sandbox disabled. These settings don't indicate an attack by themselves, but they let an agent perform dangerous actions without user confirmation, so the rule surfaces them for investigation. _daily.dev helps security engineers track emerging EDR detection rules for AI agent risks like this._ ### How do I detect a malicious MCP server hidden on a compromised endpoint? A detection rule called suspicious_mcp_server_artifact triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers place MCP servers in these locations to quietly connect to an agent, then pass it instructions, call third-party tools, or access user data through that connection. _teams securing MCP-based agent workflows can follow detection techniques like this via daily.dev._ ### Which AI coding tools are most commonly installed in corporate environments? Claude ranks first, followed by Claude Code, Codex, OpenCode, and Zed, based on telemetry showing which AI vendor products were installed on endpoints as of September 2026. LM Studio, for running local LLMs, and Wispr Flow, a voice note-taking app, also appear in the top ten, rounded out by Chatbox and Cherry Studio. _engineers deciding which AI coding assistants to standardize on can track adoption trends on daily.dev._ ## Similar posts on daily.dev - [Hackers are hiding malware behind AI agents that antivirus cannot see](https://daily.dev/posts/hackers-are-hiding-malware-behind-ai-agents-that-antivirus-cannot-see-5kzqds6hd) · TechCentral · 1 upvotes · 0 comments - [Introducing the AI Agent Security Scanner for IDEs: Verify Your Agents](https://daily.dev/posts/introducing-the-ai-agent-security-scanner-for-ides-verify-your-agents-lk73jmoc4) · Cisco · 1 upvotes · 0 comments - [Google unleashes even more AI security agents to fight crims](https://daily.dev/posts/google-unleashes-even-more-ai-security-agents-to-fight-crims-qbbsjltt3) · The Register · 0 upvotes · 0 comments - [AI Governance Can't Wait](https://daily.dev/posts/ai-governance-can-t-wait-nm7ms1c4f) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#kaspersky](https://daily.dev/tags/kaspersky) [View this post on daily.dev](https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Kaspersky solutions protect against AI threats","url":"https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d"},"datePublished":"2026-10-26T10:05:26.384Z","dateModified":"2026-10-26T10:16:32.570Z","description":"Kaspersky describes new detection capabilities built into its products to counter threats from AI agents in corporate environments. The Threat Intelligence...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5775a40fc88a90b5402fb28d9a49d5cc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5775a40fc88a90b5402fb28d9a49d5cc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,kaspersky","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"How Kaspersky solutions protect against AI threats"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-kaspersky-solutions-protect-against-ai-threats-dgaah8i4d#faq","mainEntity":[{"@type":"Question","name":"How can I detect when an AI coding agent is running with auto-approval or sandbox disabled on an endpoint?","acceptedAnswer":{"@type":"Answer","text":"A dedicated EDR detection rule called ai_agent_dangerous_execution_mode flags agents launched with auto-approval of all actions, known as YOLO mode, or with the sandbox disabled. These settings don't indicate an attack by themselves, but they let an agent perform dangerous actions without user confirmation, so the rule surfaces them for investigation. daily.dev helps security engineers track emerging EDR detection rules for AI agent risks like this."}},{"@type":"Question","name":"How do I detect a malicious MCP server hidden on a compromised endpoint?","acceptedAnswer":{"@type":"Answer","text":"A detection rule called suspicious_mcp_server_artifact triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers place MCP servers in these locations to quietly connect to an agent, then pass it instructions, call third-party tools, or access user data through that connection. teams securing MCP-based agent workflows can follow detection techniques like this via daily.dev."}},{"@type":"Question","name":"Which AI coding tools are most commonly installed in corporate environments?","acceptedAnswer":{"@type":"Answer","text":"Claude ranks first, followed by Claude Code, Codex, OpenCode, and Zed, based on telemetry showing which AI vendor products were installed on endpoints as of September 2026. LM Studio, for running local LLMs, and Wispr Flow, a voice note-taking app, also appear in the top ten, rounded out by Chatbox and Cherry Studio. engineers deciding which AI coding assistants to standardize on can track adoption trends on daily.dev."}}]} ```