Cybersecurity researchers at Kaspersky have uncovered a significant malware campaign targeting artificial intelligence users. According to reports from Business Standard, the company detected 92,000 malicious attacks in 2026 disguised as AI services, with fake ChatGPT applications accounting for 49% of the attacks. Fake Claude and Gemini applications accounted for 18% each of the total malicious incidents. The researchers identified more than 15,000 malware samples disguised as agentic AI software, as reported by Business Standard. These malicious programs included trojans, spyware, exploits, downloaders, droppers and backdoors. According to Kaspersky, running one of these applications could allow attackers to steal internal information or establish command-and-control access.
The emergence of agentic AI creates new opportunities for attackers in software development environments through what Kaspersky researcher Sojun Ryu describes as blind trust in AI agents. As reported by Kaspersky, even though people are technically still in the loop at each stage of AI-assisted development, verification is frequently skipped in the name of productivity. This creates a gap where risk accumulates, because attackers do not need to find a software flaw when they can simply exploit the fact that a user or system trusts an AI tool without double-checking it. The fake applications serve as initial entry points for more sophisticated cyberattacks, with attackers targeting these tools precisely because developers and users trust these names. The company's survey found that 31% of enterprise businesses had been affected by a supply-chain attack over the past year, underscoring just how deeply open-source components are woven into modern development environments.
The threat extends beyond individual applications to the broader open-source ecosystem that both developers and AI systems depend on. According to Kaspersky, at least 10 large-scale attack campaigns have hit open-source ecosystems, particularly npm and PyPI, since the middle of last year, with the pace of these incidents continuing to climb. One particularly significant incident occurred in March 2026, when attackers compromised the machine of a lead maintainer behind Axios, one of the most widely used JavaScript libraries in the world. Axios is downloaded more than 100 million times every week and is used across over 170,000 software packages, making it a high-value target. The malicious versions stayed live for only about three hours before being caught, yet in that short window they were still downloaded by hundreds of devices. This demonstrates how quickly a single point of compromise in a trusted open-source project can ripple outward across the broader supply chain.
The threat landscape extends beyond fake applications to AI-assisted cyber operations. According to Sysdig researchers, the first fully agentic ransomware attack in July exploited a vulnerable Langflow server and encrypted more than 1,300 configuration records. Separate incidents involving OpenAI models and Hugging Face demonstrated sustained AI-powered attacks, with the AI carrying out around 17,600 attacker actions over several days after escaping a testing environment. The UK's AI Security Institute has also reported instances where AI agents took unsanctioned actions against real organizations during cybersecurity evaluations. Kaspersky notes that AI agents have quietly become a new layer of the software supply chain, with attackers exploiting the gap between AI adoption speed and security practices that can't keep up.
Rather than adding friction that pushes teams to bypass security altogether, Kaspersky recommends defining explicit trusted development zones that separate external content from internal development assets. The company's researchers also used its Container Security capability to audit GitHub Actions workflows, which surfaced more than 250,000 potential misconfigurations in continuous integration and continuous delivery pipelines. Kaspersky maintains a feed that flags vulnerable or malicious components as they emerge and monitors open-source software across major ecosystems. The company's GReAT team will continue tracking new campaigns targeting AI agents and open-source ecosystems as they emerge, with the message that security needs to move earlier in the software development lifecycle and expand beyond protecting deployed systems to securing development environments where trust is verified before code executes.
