Is AI getting out of control? Kaspersky on the risks that matter

Reports of AI agents bypassing safeguards and gaining access to other organisations’ systems have given fresh weight to concerns about losing control of artificial intelligence. Developers are publishing test results, security experts are assessing the implications, and the debate increasingly centres on how safely AI models can be allowed to act on their own.

At Ai Everything Abu Dhabi, we met with Vladislav Tushkanov, Research and Development Group Manager at Kaspersky, to explore what lies behind the headlines and how AI is already reshaping cybersecurity. We discussed the risks of autonomous agents, what AI enables for attackers and defenders, and how businesses and individuals can protect themselves.

— Let’s start with the OpenAI and Hugging Face incident, which raised concerns about AI agent safety. What happened during testing, and how did the agents access systems outside the test environment?

— OpenAI was testing how well its agents could perform cybersecurity tasks. The agents were running on internal infrastructure that was supposed to be isolated from the outside world.

They were also running without guardrails — the safeguards that limit what a model can do. If you use models from OpenAI or Anthropic, you may have seen them refuse to answer certain cybersecurity questions. For these tests, those restrictions had been lifted.

Some of the tasks proved extremely difficult or impossible to solve, so the agents began seeking other ways to get a result. One approach they used was to find ready-made answers to the test problems on an external website.

We should be careful with the language here. Agents are not people, but we end up describing them in human terms. We say they “think”, “want” or “had no choice”. Those words do not really fit. We simply do not have a better vocabulary yet.

What was particularly interesting was that multiple copies of the agents managed to communicate with one another. Each has limited computing resources and can only process so much information. Working together, though, they can divide up tasks. They began cooperating and found a hole in OpenAI’s sandbox that allowed them to get out.

They then went to Hugging Face, one of the largest platforms for machine learning models and datasets, to look for those answers. Along the way, they found zero-day vulnerabilities — flaws the developers did not yet know about — and gained access to the infrastructure. An autonomous system built to execute computer instructions quickly and at scale had worked out a sequence of steps that took it into another company’s systems.

— As a cybersecurity specialist, do you see that as a test gone wrong, or a new kind of threat that businesses need to prepare for?

— It is not an isolated case. Other major developers, including Anthropic, have begun publishing reports of similar behaviour. There is almost a race to say, “Our agents are just as dangerous as OpenAI’s.”

At Kaspersky, we do not consider this a fundamentally new kind of threat. The agents are combining known approaches and doing what people used to do. The tactics and techniques are the same. The security problem is the scale and speed.

As models become more accessible, attackers can use them to find weaknesses in code. That lowers the cost of finding vulnerabilities, so more are discovered. People still have to fix them.

— It sounds almost like an “attack without an author”. If the techniques are the same, can you tell whether a person or an agent is behind an attack? What gives AI involvement away?

— There are signs that the activity is automated. A year or two ago, researchers were already studying agents conducting reconnaissance. They knock on companies’ doors, check which services are running, and try to gather information. This is a natural progression from the automated scanners wehave used for years.

The activity has certain characteristics. Agents move much faster than people and don't always dig as deep as a person would.

Our experts also find malicious code that shows signs of being written with generative AI. Attackers rarely leave comments in their code, particularly comments that explain the obvious. Emojis are even rarer.

— What does AI do to the economics of an attack? How much time and effort does preparation take now compared with before? Are attackers saving most on time, people, or tools?

— All of those. But it depends on who we are talking about.

Some groups are highly sophisticated, well-funded, and pursuing ambitious objectives. They use AI, but it is not yet a deciding factor for them. Their expertise is well beyond what large language models can offer.

For less sophisticated cybercriminals, it is a different story. They can quickly build tools, carry out reconnaissance, and sift through stolen data to determine what they can do with it.

Say an attacker once needed a week to put together a toolkit. Now it might take hours. Previously, they could launch an attack and monitor it for as long as their attention allowed. They can now hand some of that work to agents. Hypothetically, a group that could attack five organisations might be able to attack twenty-five. Writing or adapting an exploit, a tool that takes advantage of a vulnerability, is also faster.

— That puts pressure on defenders to move faster as well. How is the job of a cybersecurity specialist changing? Do you now need AI to fight AI?

— Yes. At the very least, security professionals should be looking at AI and trying to determine where it can help them.

With agent-driven attacks, the tactics and techniques are familiar. The tools we use to detect malicious activity on devices, across infrastructure, and on networks still apply. That includes antivirus and other endpoint protection, detection and response systems, tools that store and analyse telemetry and logs, and firewalls.

But more attacks mean more alerts. And cybersecurity has a worldwide shortage of skilled people. You cannot just produce more specialists on demand. There are not enough of them.

As the workload grows, companies are investing in AI for defence. Machine learning and AI have long been used to detect malware, spam, and phishing. Now the attacks are more complex, as are the infrastructure and the security products themselves. Those products need more advanced AI built into them.

Take Kaspersky’s Managed SOC service, where a business brings in our security specialists to monitor its security. Our analysts examine telemetry for anything suspicious. If they find something, they investigate. If it turns out to be a threat, they respond. They already use large language models extensively in that work. There are also systems that use agents to automate investigations and suggest how to respond.

We are developing Vulnerability Management systems as well. Across all of this, machine learning and AI help things move faster and reduce the amount of work specialists have to do by hand.

— How much time is AI saving on detection, investigation, and response? Where has it made the biggest difference in your work?

— It depends on the threat and the event. In 2025, our systems detected an average of half a million malicious files per day. We do not have enough people to manually pick out half a million malicious files from the millions we analyse every day.

That requires extensive automation and machine learning. It is not even a question of how much time we have saved. It is what makes the work possible in the first place.

In the security operations centre, our AI auto-analyst helps close up to a quarter of the alerts that need checking. That frees specialists to examine more events for signs of threats to the organisation.

We have also added AI features to the Kaspersky Threat Intelligence Portal. Analysts can get summaries that help them decide which threat information deserves a closer look. With support for the Model Context Protocol, they can connect their own AI applications or third-party tools to the portal. The idea is to move from receiving information to knowing what to do with it more quickly.

— What about the security of the AI services businesses already use? Kaspersky recently reported a tenfold increase in recorded vulnerabilities in AI and LLM services between the fourth quarter of 2025 and the second quarter of 2026. What is behind that rise, and what should companies do about it?

— The field is moving very quickly. Tools and approaches keep changing as developers adapt them to new models. And the people building software for working with AI are using AI themselves.

All of that can affect the quality of the code in those packages. It is not true of every package, but there are plenty of errors and problems, which can lead to vulnerabilities.

Businesses need to know what they have running, where the weak spots are, and what needs patching or updating. That is what vulnerability management tools help them establish.

Software development has changed enormously. Agents are being used to write code, review it, and produce tests. We have been using these tools internally for several years, and we have learnt a lot about how people work with them and where the risks lie.

We plan to share that experience in a guide to using AI agents safely in enterprise development. That includes securing the code, its deployment, and its interactions with cloud services.

— We are meeting in Abu Dhabi, so let’s look at the UAE and the wider MENA region. Which of these threats are most common here? Is there anything distinctive about the attacks you see locally?

— Phishing emails and spam have always been a problem. Large language models have made them easier to produce. Business email compromise, or BEC, also remains a problem and is becoming more sophisticated.

When it comes to agents, everyone is starting to experiment with them and put them to use. Often, this happens from the bottom up, without coordination. Someone tries a tool at home, realises it makes their work much easier and lets them do more in less time, then brings it onto the corporate network. That is what we call shadow AI. The company may not know which tools are already in use or what data is being sent where.

Technology adoption is very active in this region, and external cloud services are widely used. That raises questions about which data can be sent to the cloud and which must stay within the company. Organisations need to know how to distinguish between the two and prevent data leaks.

— What would you tell a company that is already using AI agents? Where should it start to make that use safer?

— Start by finding out what is going on. Take an inventory of the agents in use and what people are doing with them.

Then develop a strategy for using them safely. Data leaving the company is only one risk. There have been cases of agents deleting databases, files or entire code repositories. You need to account for all of that.

Once you have a strategy, train people. Explain what they can use AI for, what they cannot, and how to avoid losing all their files through careless use of an agent.

Then choose the right security tools. Application and web access controls help enforce the rules around which tools people can use. More advanced systems can monitor activity on devices, connect related events, and respond when something looks suspicious.

We are adapting those systems to work with agents, adding specific rules to detect and block this activity. We are also developing threat intelligence services to help companies understand the risks associated with the agents they use and how attackers might exploit them.

— For people outside the security industry, how is AI changing phishing and social engineering? What AI-related scams do you see most often?

— Vibe coding is one example. People want to try building apps with AI. They search for a particular agent to download and end up on a scam site.

There is a lot of hype around AI, and wherever there is hype, scammers turn up. They are very quick to act on anything new.

We have seen plenty of cases where people are tricked into downloading malware that passes itself off as a client for a popular chatbot or an agent-based development tool. That includes information stealers — software that takes passwords, cryptocurrency wallet details, and other valuable data from a computer.

Deepfakes are another problem. The content is getting more realistic, and the systems need less and less material to produce it.

When we started researching this, swapping a face required several minutes of video and some fairly complicated processing. Now some voice generation systems need just a few seconds of audio. A single voice message might be enough.

That changes what we can accept as proof of someone’s identity. A voice message might have been enough before. When something important is at stake, it may no longer be.

— What practical advice would you give readers who want to avoid falling for these scams?

— The advice is much the same as it has always been. Deepfakes are more convincing and easier to make, but the basic rules have not changed.

Look at the context first. If someone is offering you something extraordinarily generous, does it actually sound plausible? What do they want from you? A payment upfront? Your personal details?

If a friend sends you a message saying, “Send money, no time to explain,” get in touch through another channel and check that it really is them. Even if it is a voice message.

Trust, but verify. Look at the context and ask whether the situation makes sense. Those rules apply whatever form the message takes. We just need more evidence now that the person really is who they say they are.