This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bankβs rules.
βAre you protecting me, or are you protecting your own profits?β
Bianco described traditional financeβs business model as βbased on laziness.β Customers may leave idle cash in low- or no-interest bank accounts rather than move it into a money market fund. An AI agent could make that move for them. βNow that youβre able to do it, the banks are afraid theyβre gonna lose that revenue stream,β he said.
The banks offer a different explanation. JPMorgan Chase CEO Jamie Dimon said the bank wouldnβt allow just any outside agent into its systems because doing so was βtoo risky for clients and for JPMorgan.β
Both explanations can be true: banks can want to retain deposits while also facing real security problems when software acts through customersβ accounts.
Handing over your banking login introduces another service into the security chain. A vulnerability in that service could expose your credentials or allow your account to be misused. And as Bank of America reportedly pointed out:
Β βIf you do share your credentials, keep in mind that youβre responsible for activity resulting from that access.β
Thatβs the bankβs stated position, not a universal ruling on consumersβ legal rights. Still, itβs a warning worth taking seriously.
Pros and cons
An AI agent with permission to make purchases might find and buy an item at a lower price. But giving an agent access to your bank account also means sharing sensitive banking information with a third party. Weβve seen shared AI chats become searchable online too.
Axios reported that many banks allow, or are moving toward allowing, read-only access. This can let a tool analyze transactions without giving it permission to move money.
Thatβs an important boundary, but it doesnβt make the information harmless. An agent that can read bank statements may still disclose them if itβs compromised or manipulated. Preventing transactions and protecting confidentiality are separate security goals.
How to keep control of your money
For consumers, the practical question is not whether banks have perfectly selfless motives. Itβs what access youβre giving away, and what could happen if the agent makes a mistake.
Donβt paste banking passwords or security codes into a general-purpose AI assistant. Major banks have explicitly warned customers against sharing their credentials.
Use your bankβs approved connection methods rather than giving an agent your login. Where supported, choose read-only access if all you need is analysis or budgeting help.
Give agents access to as little sensitive information as possible. An assistant comparing publicly advertised savings rates doesnβt need your bank statements. OpenAI recommends limiting agents to the data and credentials they need for the task.
Review consequential actions yourself. If an agent asks for confirmation, check exactly what it intends to do and what information it will share. Donβt treat a confirmation prompt as a formality.
AI can make it easier to compare financial products and spot opportunities you might otherwise miss. But an assistant that finds a better rate and an agent that can act inside your account are different propositions.
Let it help with the homework, but be cautious about handing it the keys.
LetβsΒ face it, an incognito window can only do so much.Β Β Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft ProtectionΒ monitors for all of it, alerts you fast, and comes with identity theft insurance.Β
This week, Axios reported that major US banks were detecting third-party AI agents operating inside customer accounts. In many cases, customers have given the agents their usernames and passwords so they could act on their behalf. This kind of access can violate a bankβs rules.
βAre you protecting me, or are you protecting your own profits?β
Bianco described traditional financeβs business model as βbased on laziness.β Customers may leave idle cash in low- or no-interest bank accounts rather than move it into a money market fund. An AI agent could make that move for them. βNow that youβre able to do it, the banks are afraid theyβre gonna lose that revenue stream,β he said.
The banks offer a different explanation. JPMorgan Chase CEO Jamie Dimon said the bank wouldnβt allow just any outside agent into its systems because doing so was βtoo risky for clients and for JPMorgan.β
Both explanations can be true: banks can want to retain deposits while also facing real security problems when software acts through customersβ accounts.
Handing over your banking login introduces another service into the security chain. A vulnerability in that service could expose your credentials or allow your account to be misused. And as Bank of America reportedly pointed out:
Β βIf you do share your credentials, keep in mind that youβre responsible for activity resulting from that access.β
Thatβs the bankβs stated position, not a universal ruling on consumersβ legal rights. Still, itβs a warning worth taking seriously.
Pros and cons
An AI agent with permission to make purchases might find and buy an item at a lower price. But giving an agent access to your bank account also means sharing sensitive banking information with a third party. Weβve seen shared AI chats become searchable online too.
Axios reported that many banks allow, or are moving toward allowing, read-only access. This can let a tool analyze transactions without giving it permission to move money.
Thatβs an important boundary, but it doesnβt make the information harmless. An agent that can read bank statements may still disclose them if itβs compromised or manipulated. Preventing transactions and protecting confidentiality are separate security goals.
How to keep control of your money
For consumers, the practical question is not whether banks have perfectly selfless motives. Itβs what access youβre giving away, and what could happen if the agent makes a mistake.
Donβt paste banking passwords or security codes into a general-purpose AI assistant. Major banks have explicitly warned customers against sharing their credentials.
Use your bankβs approved connection methods rather than giving an agent your login. Where supported, choose read-only access if all you need is analysis or budgeting help.
Give agents access to as little sensitive information as possible. An assistant comparing publicly advertised savings rates doesnβt need your bank statements. OpenAI recommends limiting agents to the data and credentials they need for the task.
Review consequential actions yourself. If an agent asks for confirmation, check exactly what it intends to do and what information it will share. Donβt treat a confirmation prompt as a formality.
AI can make it easier to compare financial products and spot opportunities you might otherwise miss. But an assistant that finds a better rate and an agent that can act inside your account are different propositions.
Let it help with the homework, but be cautious about handing it the keys.
LetβsΒ face it, an incognito window can only do so much.Β Β Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft ProtectionΒ monitors for all of it, alerts you fast, and comes with identity theft insurance.Β
On October 27, Google issued a new Stable channel update for Chrome.
Most users are on Chromeβs Stable channel. The desktop update brings Chrome to versionsΒ 156.0.8078.73/.74 for Windows andΒ Mac andΒ 156.0.8078.73 forΒ Linux. The update includes 52 security fixes, including four rated Critical.
On the same day, Mozilla issued Security Advisory 2026-118, which fixes 167 vulnerabilities. Firefox 159 also introduces several new features.
Both updates will roll out over the coming days and weeks.
How to update Chrome
The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.
If you donβt want to wait for the rollout to reach you, manually updating is easy. OpenΒ About Google ChromeΒ from Chromeβs settings or Help menu. Chrome will check for updates. If one is available, clickΒ RelaunchΒ to apply it.
To update Firefox, open the browser and click the menu button at the right side of the Firefox toolbar, then go to Help and select About Firefox. The About Mozilla Firefox window will open.
Firefox will automatically check for updates. If one is available, it will be downloaded. Once done, youβll be prompted to click Relaunch. After Firefox restarts, it will be up to date.
After the update, the version should be 159.0 or later
Technical details
These Chrome and Firefox updates address a familiar problem: browser code mishandling memory while processing web content. Both releases fix use-after-free vulnerabilities, including flaws in page layout, JavaScript processing, and SVG graphics.
A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.
Thereβs another connection between these updates: both Google and Mozilla credit OpenAI Codex Security with finding bugs fixed in these releases. AI can help security teams examine browser code for weaknesses, alongside human code reviews and automated tests that check how software handles unexpected inputs.
Mozillaβs collaboration with Anthropic shows how AI-discovered findings can lead to fixes: researchers validated vulnerabilities before reporting them, giving Mozillaβs team reproducible bugs to investigate, repair, and deliver to users.
Browse likeΒ no oneβsΒ watching.Β
Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you readΒ doesnβtΒ have to feel personal.Β Try it free βΒ
On October 27, Google issued a new Stable channel update for Chrome.
Most users are on Chromeβs Stable channel. The desktop update brings Chrome to versionsΒ 156.0.8078.73/.74 for Windows andΒ Mac andΒ 156.0.8078.73 forΒ Linux. The update includes 52 security fixes, including four rated Critical.
On the same day, Mozilla issued Security Advisory 2026-118, which fixes 167 vulnerabilities. Firefox 159 also introduces several new features.
Both updates will roll out over the coming days and weeks.
How to update Chrome
The easiest option is to allow Chrome to update automatically. But you can end up lagging behind on updates if you never close your browser or if something goes wrong, such as an extension preventing the update.
If you donβt want to wait for the rollout to reach you, manually updating is easy. OpenΒ About Google ChromeΒ from Chromeβs settings or Help menu. Chrome will check for updates. If one is available, clickΒ RelaunchΒ to apply it.
To update Firefox, open the browser and click the menu button at the right side of the Firefox toolbar, then go to Help and select About Firefox. The About Mozilla Firefox window will open.
Firefox will automatically check for updates. If one is available, it will be downloaded. Once done, youβll be prompted to click Relaunch. After Firefox restarts, it will be up to date.
After the update, the version should be 159.0 or later
Technical details
These Chrome and Firefox updates address a familiar problem: browser code mishandling memory while processing web content. Both releases fix use-after-free vulnerabilities, including flaws in page layout, JavaScript processing, and SVG graphics.
A use-after-free vulnerability occurs when a program attempts to access a memory location after it has been freed. That can cause crashes or, in some cases, allow an attacker to run their own code.
Thereβs another connection between these updates: both Google and Mozilla credit OpenAI Codex Security with finding bugs fixed in these releases. AI can help security teams examine browser code for weaknesses, alongside human code reviews and automated tests that check how software handles unexpected inputs.
Mozillaβs collaboration with Anthropic shows how AI-discovered findings can lead to fixes: researchers validated vulnerabilities before reporting them, giving Mozillaβs team reproducible bugs to investigate, repair, and deliver to users.
Browse likeΒ no oneβsΒ watching.Β
Malwarebytes Privacy VPN encrypts your connection and never logs what you do, so the next story you readΒ doesnβtΒ have to feel personal.Β Try it free βΒ
Launching the expanded AI Classroom Toolkit with Cyberlite during Global Media and Information Literacy WeekΒ
AI is opening new pathways to information, giving people faster access to answers, ideas, and knowledge. At the same time, itβs making it harder to know whether the content we see is authentic.Β
Companies that build AI have a responsibility to make it reliable and trustworthy, and that responsibility doesnβt shift to the people who use it. But AI is already shaping how people search, learn, and encounter information. Helping people navigate that reality means building media and AI literacy (MAIL): the judgment to decide whether and how to use AI and what information to trust. These skills are as foundational as AI safety, and educators are asking for help teaching them.Β
Thatβs why, during Global Media and Information Literacy Week, weβre launching the expanded AI Classroom Toolkit: Unlocking Generative AI Safely and Responsibly, created with the online safety organization Cyberlite. Itβs part of Microsoftβs broader commitment to make sure AI strengthens human thinking rather than replaces it. It also reflects Microsoftβs focus on education and empowerment, a core pillar of our Safe Participation Framework.Β
Whatβs new in the AI Classroom Toolkit
The expanded toolkit adds a deeper focus on critical thinking, verification, and media and AI literacy, helping students judge AI outputs and make informed decisions about what to trust online. Together with the original modules, itβs now a single, classroom-ready resource that covers the core of AI safety and literacy. Realistic, scenario-based lessons and activities help students practice these skills in situations they may encounter online:Β
The Climate Campaign: Gina enters an online challenge to make a campaign for a cause she cares about and finds that some winning entries use AI to show events that never happened. Students sort a feed of real and AI-made posts and practice lateral reading. The lesson: whether a post was made with AI doesnβt decide whether itβs trustworthy. What it claims, and who is behind it, does.Β
The Helpful Bot: Alex creates an AI help bot inside his online game, then catches it inventing details and collecting playersβ personal information. Students learn why AI can get things wrong, how to trace claims to reliable sources, and why theyβre responsible for AI-generated content they act on or share.Β
What Kind of AI User Are You?: An interactive quiz, hosted by Cyberlite, helps students identify their AI habits, strengths, and potential blind spots, and gives them an AI Type to reflect on and discuss.Β
βWhen we created the first Classroom Toolkit: Unlocking Generative AI Safely and Responsibly with Microsoft in 2023, most of the conversation was about using AI safely. Today, the questions young people ask about AI have grown sharper and more personal, like what to believe online or how far to trust a chatbotβs answer,β said Michelle Yao, cofounder of Cyberlite.Β
The toolkit also reflects what young people in our co-design sessions with Cyberlite told us: they want to learn by doing, through games, real-life scenarios, and peer discussion. Teachers donβt need to be AI experts, and students donβt need an AI tool in hand to start.Β
That approach builds on the reach and results of the original toolkit. Since 2023, the first version has reached educators in 10 countries and 11 languages, including through government and partner learning platforms. In South Korea, 93% of participating educators reported improved knowledge and understanding of ethical issues, privacy, and bias related to AI.Β
βOur hope is that every student leaves a little surer of their own judgment, and that everyone feels more confident deciding how AI fits into their lives,β said Yao.Β
Literacy works alongside product design and policy
Education is one part of the equation. Our commitment to media and AI literacy also shows up in how we design products and the policies we support.Β Β
Last month, we set out five principles for AI in education, including βAI designed to support studentsβ learning, not replace their thinking.β We alsocommitted to enforceable privacy, safety, and transparency protections for qualifying educational AI products in US school districts. These protections help schools and families understand how these tools work and the controls available to them.Β
Media and AI literacy is now a global priority
The Organisation for Economic Co-operation and Development has released a framework for a MAIL assessment beginning in 2029. As part of its Programme for International Student Assessment (PISA), it will examine how students reflect on, analyze, and evaluate information, including AI-generated information. This week in New Delhi, UNESCO is also launching an AI extension of its βThink Critically, Click Wiselyβ global curriculum, which Microsoft advised on.Β
This growing global focus makes the need for support urgentβeducators want help, and many arenβt getting it. In Microsoftβs 2026 AI in Education report, 53% of educators and 77% of students say they havenβt had AI training. Β
Closing this skills gap matters beyond the classroom. Healthy societies depend on a shared basis of facts, informed public debate, and confident civic participation.β―As authenticity gets harder to judge, thereβs a risk that people start doubting everything, creating what the Digital Inquiry Group calls a βdangerous declaration of permanent uncertainty.β MAIL offers a way through. It builds the confidence to decide what to trust.Β
Media and AI literacy for every age
Across Microsoft, weβre helping people build these skills wherever they learn and find information:Β
In classrooms: Students debate whether to accept, question, or rework an AI toolβs answers in an AI and Critical Thinking lesson from The Economist Educational Foundation, supported by Microsoft. Available alongside other media literacy lessons in Microsoft Learning Zone, the lesson has reached students in 116 countries.Β
Through play: Millions of players have checked sources, spotted bias, and cracked cases of AI misuse in Minecraft Educationβs The Investigators and Reed Smart: AI Detective.Β
For content creators: UNESCO, with Microsoftβs support, is developing resources to help creator associations train their members in MAIL and is testing them with creators in Nairobi this week. Β
For voters: Check. Recheck. Vote. helps people apply AI literacy to election information.Β
In our products: Search Progress, built with input from the Digital Inquiry Group, turns research assignments into source-checking practice in Microsoft Teams for Education.Β
Whatβs nextΒ
Through Microsoft Elevate for Educators and local partners, weβll bring the AI Classroom Toolkit to new audiences, with more languages and localized content rolling out through 2027. Weβll keep evolving it as technology and educatorsβ needs change.Β
AI will keep changing how people find information and the content they encounter. Our goal is to help people meet that change with confident, informed judgment about the AI they use and the information they trust so they can fully take part in civic and democratic life.Β
Ransomware operators are scaling their attacks, and the barriers to entry continue to fall. In the first half of 2026, Flashpoint identified 6,256 ransomware attacks across industries, representing a 45% increase between 2025 and 2026, as Ransomware-as-a-Service (RaaS) operations expanded and threat actors increasingly leveraged AI, stolen credentials, and vulnerability exploits to accelerate their campaigns.
The impact is widespread. Manufacturing accounted for 18% of observed attacks, followed by business services and consulting (13%) and healthcare (9%). Meanwhile, prolific ransomware groups such as Qilin and Akira continue to demonstrate the scale at which these operations can function.
Understanding how ransomware attacks develop, and where they can be interrupted, is critical for defenders.
Introducing Ransomware in the Age of AI: A Survival Guide for Defenders
Flashpointβs new guide, Ransomware in the Age of AI: A Survival Guide for Defenders, provides cyber threat intelligence professionals, threat hunters, and security leaders with a practical look at the modern ransomware attack lifecycle, from initial reconnaissance and access to incident response and recovery.
Drawing on Flashpointβs primary-source intelligence and analysis of evolving threat actor tactics, the guide explores how organizations can identify opportunities to disrupt attacks before they escalate, strengthen incident response, and reduce the risk of repeat compromise.
Access the guide to learn:
How modern ransomware attacks unfold: Follow the attack lifecycle, from reconnaissance, phishing, and initial access through lateral movement, encryption, and ransom negotiations.
Where defenders can intervene: Understand how compromised credential monitoring, vulnerability intelligence, and visibility into underground activity can help identify threats before attackers reach critical systems.
How AI is reshaping ransomware operations: Explore how AI-enabled capabilities, commoditized tooling, and RaaS ecosystems are changing the economics and execution of ransomware attacks.
How to strengthen response and recovery: Learn strategies for containing active incidents, restoring operations, improving cross-team coordination, and reducing exposure to repeat attacks.
βIn H1 2026, Flashpoint observed a 45% surge in ransomware activity, with critical sectors like manufacturing, business consulting, and healthcare taking the brunt of these attacks. As RaaS syndicates like Qilin and Akira scale their operations alongside a 27% rise in infostealers, access is becoming faster and cheaper. Effective defense requires grounding incident response in primary-source intelligence across every phase of the attack lifecycle.β
Ian GrayVP of Intelligence, Flashpoint
Understanding the Modern Ransomware Attack Lifecycle
Ransomware attacks rarely begin with encryption. Long before systems are locked or ransom demands appear, threat actors may be gathering intelligence on potential targets, exploiting exposed vulnerabilities, or acquiring stolen credentials through underground marketplaces.
Flashpoint observed a 27% increase in infostealer operations in H1 2026 compared to H1 2025, underscoring the growing role of compromised identities in the ransomware ecosystem. Stolen credentials and session data can provide attackers with access to organizational environments, potentially allowing them to bypass traditional defenses and establish a foothold.
These initial access methods are increasingly interconnected with broader criminal operations. RaaS groups can leverage specialized tools and services throughout the attack chain, while AI-enabled capabilities offer additional opportunities to automate and accelerate certain activities.
This creates multiple opportunities for defenders to act. Intelligence about exposed credentials, emerging exploitation activity, and threat actor behavior can help security teams identify risks earlier and prioritize defensive action before an intrusion progresses.
The guide examines these opportunities across the ransomware lifecycle, outlining how proactive intelligence and coordinated response can help organizations minimize operational disruption and strengthen resilience.
Build a More Proactive Defense Against Ransomware
As ransomware operations continue to evolve, organizations need visibility into the threats targeting their environments and the intelligence to respond at every stage of an attack.
From identifying compromised credentials and monitoring emerging threats to containing incidents and preventing repeat attacks, a lifecycle-based approach helps security teams make more informed decisions before, during, and after a ransomware incident.
Get the Ransomware in the Age of AI: A Survival Guide for Defenders to explore the modern ransomware attack lifecycle and learn how Flashpointβs threat intelligence can help your organization anticipate, disrupt, and recover from ransomware attacks.
AI is becoming a third wheel in relationships, increasingly playing a role in the most intimate parts of our lives. Β
It shows up in the flirty first text, the polished dating profile, the therapized language we use with a partner after a fight, the strength we gather after heartbreak, and everywhere in between. For some, AI is a source of companionship itself. And even if youβre not personally an AI user, you may still be dating, loving, arguing with, or trusting someone who is.Β
As AI moves deeper into our relationships, itβs reshaping connection, blurring what feels authentic, and creating new ways for intimacy to be exploited.Β
AI is starting to replace human interactionΒ
AI is moving into emotional territory once reserved for other people. For some, itβs no longer just a tool, but a source of support, companionship, and even romantic connection.Β
According to our recent research, about one in six have turned to a chatbot for companionship or emotional support. That climbs to about one in five among Gen Z and Millennials, and nearly one in four among regular AI users (those who use AI daily or multiple times a week). The more time people spend with AI, the more likely they are to humanize its role, making room for it as a friend, confidant, advisor, or even partner. Β Β
As AI takes on more intimate roles, itβs also starting to challenge the boundaries of real human relationships. More than one in three (37%) say having a romantic relationship with an AI chatbot while already in a committed relationship isnβt the same as cheating. That view is more common among men (46% versus 30% of women), Gen Z and Millennials (43% and 45%), and regular AI users (48%).Β
Whether the relationship is platonic or romantic, the more AI is treated like a human, the more personal the stakes become. Just like you have to be cautious when telling a human your deepest, darkest secrets, the experience is similar when using AI. Nearly two-thirds (65%) worry that private conversations theyβve had with AI could be exposed.Β Β
One survey respondent said:
βI have used a chatbotβ¦for emotional support, and it is worrying to think those conversations could be leaked.β
The technology may be artificial, but the relationships people form with AI can feel very real. And as with any relationship, that means there are boundaries to work out, privacy to protect, and vulnerabilities to manage.Β
AI is creating new ways to weaponize intimacyΒ
AIβs growing role in human intimacy also has a darker side. The same technology that can offer comfort, advice, or companionship can also be used to violate the most intimate parts of our lives.Β
Non-consensual image abuse, sextortion, and other forms of sexual abuse have long been part of the internetβs dark side. Generative AI has made that content easier to create. Someone trying to exploit another person no longer needs an actual intimate photo, video, or private exchange. A regular photoβor even just someoneβs likenessβcan be transformed into sexual content they never made, never shared, and never consented to.Β
Most people draw a clear line against that, but not everyone does. About one in six people say itβs acceptable to generate explicit images of someone without their permission for personal use. Another 14% are neutral, bringing the share who do not explicitly oppose the behavior to nearly one in three (31%).Β Β
Views differ sharply by age and sex:Β
Younger adults are more accepting of someone using AI to generate non-consensual content: nearly one in four Gen Z (24%) and Millennials (23%) say itβs okay, compared with 13% of Gen X and just 5% of Boomers+Β
Men are also more permissive: more than one in five (22%) say itβs okay, compared with 14% of womenΒ
Attitudes toward the behavior may vary, but the fear of becoming a target is far more widespread. Overall, nearly two-thirds of people (62%) worry someone could create fake nude or sexually explicit photos or videos of them. Women feel this threat more acutely: nearly seven in ten (69%) are concerned, compared with 57% of men.Β
For some, this fear has already become a reality:Β Β
One in ten say AI has been used to generate nude or sexually explicit imagery of them without permissionΒ
One in ten say someone has threatened to release AI-generated compromising or explicit imagery of themΒ
As one respondent recounted:Β
βI had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebookβ¦[it] made me more cautious about AI.β
The intimate material may be fake, but the fear, coercion, and potential for reputational, emotional, and financial damage are completely real.Β
AI is making it harder to know who youβre really talking toΒ Β
The threat doesnβt stop with fabricated sexual content. AI is also making it harder to know whether the person on the other side of a screen is who they claim to be.Β
Humans have always edited themselves for other people. We choose the most flattering photo, write and rewrite the text before sending it, and present our most interesting selvesβespecially when forming new relationships. AI dramatically expands what that kind of self-editing can look like, and people arenβt shy about using it:Β
54% say AI helps them present the best version of themselvesΒ Β
47% say using AI to present your βbest selfβ to employers, friends, or romantic partners does not present a false identityΒ
That rises to 58% of both Gen Z and Millennials and 64% of regular AI usersΒ
But where does enhancement end and deception begin? Is an AI-polished dating profile still authentically you? What about a message you didnβt write? A photo that looks like you, only better?Β
Thereβs a flipside to using AI to make ourselves look or sound better: If we can do it, so can everyone else. And people are much less comfortable when theyβre not the ones controlling the technology. Two-thirds (67%) worry that an online friend or romantic interest could use AI-generated images, videos, or other content to deceive them.Β Β
Catfishing, fake photos, and lies on dating profiles arenβt new. AI just makes the deception easier. Someoneβs photos, backstory, messages, and even their voice can all be faked.Β Β
One person described leaving dating apps after realizing the person they were talking to had gone well beyond simply polishing their profile:Β
β[The] dating profile had fake picturesβ¦[it] wasnβt just making true events sound interesting and more flirty, but creating completely false photos and information. Left the dating apps again and needed to reset.β
AI can distort identity in the other direction, too. It can also create a version of us we never chose to put into the world.Β Β
76% worry about someone creating a fake profile pretending to be themΒ
70% worry about fake images or videos of themselves being createdΒ
71% worry AI-generated content could be used to damage their reputationΒ
Relationships are built on mutual trust. AI can distort both sides of the connection: who we think the other person is, and who they think we are.Β Β
AI is quietly finding its way into the space between peopleΒ Β
Not all of AIβs influence on intimacy is so dramatic. Much of it happens quietly, showing up in how people communicate with each other and navigate relationships:Β
More than one in three have used AI to help write or edit a messageΒ
About one in seven have turned to it for advice about a relationship or personal decisionΒ
One in ten say it has already changed how they date or communicate romanticallyβrising to nearly one in five among Gen ZΒ
The survey responses show what this looks like in real life. For example, one respondent described using AI with their partner as a way to step outside their own point of view:Β
βPersonally, it has helped me. We use AI in our relationship as a reflection tool, and it has sometimes helped us take on the perspective of the other.β
For another, AI helped them work through jealousy:Β Β
βSo, I used to accuse my partner, and I got really territorial about them but once I talked to AI about it, they gave helpful advice and now we are stronger than ever.β
AI is also showing up in other difficult relationship moments. One person said it helped them βstay calm and communicateβ when problems came up with their partner; another said it allows them βto pause and refine [their] thoughtsβ before responding.Β
Sometimes the role is simpler. One respondent said AI gives them βnew romantic wordsβ for their partner, while another said theyβve asked AI for advice on how to make their partner smile. AIβs growing role in relationships may be unsettling, but the benefits people describe are definitely there.Β
AI isnβt just helping people find the right words. Itβs also helping them decide what version of themselves to put forward in the first place. More than one in three say itβs okay to use AI to create or improve a dating profile; nearly two-thirds arenβt opposed. One respondent described using AI as a βcreative advisorβ to polish their profile and come up with conversation starters.Β
AI doesnβt have to replace a relationship to help shape it. It can influence how people communicate, what advice they take, and how they choose to present themselves.Β Β
AIβs intimacy problem is ultimately a trust problemΒ
From connection to deception to outright harm, the same question keeps surfacing: Can I trust whatβs in front of me? And would I know if I couldnβt?Β
Nearly nine in ten people (88%) say AI is making it harder to tell what online content is genuinely human or real. And 84% say even convincing video evidence no longer necessarily feels like proof. That uncertainty follows people into dating and relationships, where knowing whatβand whoβto trust is deeply personal.Β
AI may make it easier to start a conversation, smooth over a hard one, or feel connected when youβre lonely. But relationships and intimacy of all kinds still come down to trust, and AI is making that trust a little harder to take at face value.Β
About the researchΒ
The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. The research was prepared by an independent research consultant and distributed via Forsta.Β
AI is becoming a third wheel in relationships, increasingly playing a role in the most intimate parts of our lives. Β
It shows up in the flirty first text, the polished dating profile, the therapized language we use with a partner after a fight, the strength we gather after heartbreak, and everywhere in between. For some, AI is a source of companionship itself. And even if youβre not personally an AI user, you may still be dating, loving, arguing with, or trusting someone who is.Β
As AI moves deeper into our relationships, itβs reshaping connection, blurring what feels authentic, and creating new ways for intimacy to be exploited.Β
AI is starting to replace human interactionΒ
AI is moving into emotional territory once reserved for other people. For some, itβs no longer just a tool, but a source of support, companionship, and even romantic connection.Β
According to our recent research, about one in six have turned to a chatbot for companionship or emotional support. That climbs to about one in five among Gen Z and Millennials, and nearly one in four among regular AI users (those who use AI daily or multiple times a week). The more time people spend with AI, the more likely they are to humanize its role, making room for it as a friend, confidant, advisor, or even partner. Β Β
As AI takes on more intimate roles, itβs also starting to challenge the boundaries of real human relationships. More than one in three (37%) say having a romantic relationship with an AI chatbot while already in a committed relationship isnβt the same as cheating. That view is more common among men (46% versus 30% of women), Gen Z and Millennials (43% and 45%), and regular AI users (48%).Β
Whether the relationship is platonic or romantic, the more AI is treated like a human, the more personal the stakes become. Just like you have to be cautious when telling a human your deepest, darkest secrets, the experience is similar when using AI. Nearly two-thirds (65%) worry that private conversations theyβve had with AI could be exposed.Β Β
One survey respondent said:
βI have used a chatbotβ¦for emotional support, and it is worrying to think those conversations could be leaked.β
The technology may be artificial, but the relationships people form with AI can feel very real. And as with any relationship, that means there are boundaries to work out, privacy to protect, and vulnerabilities to manage.Β
AI is creating new ways to weaponize intimacyΒ
AIβs growing role in human intimacy also has a darker side. The same technology that can offer comfort, advice, or companionship can also be used to violate the most intimate parts of our lives.Β
Non-consensual image abuse, sextortion, and other forms of sexual abuse have long been part of the internetβs dark side. Generative AI has made that content easier to create. Someone trying to exploit another person no longer needs an actual intimate photo, video, or private exchange. A regular photoβor even just someoneβs likenessβcan be transformed into sexual content they never made, never shared, and never consented to.Β
Most people draw a clear line against that, but not everyone does. About one in six people say itβs acceptable to generate explicit images of someone without their permission for personal use. Another 14% are neutral, bringing the share who do not explicitly oppose the behavior to nearly one in three (31%).Β Β
Views differ sharply by age and sex:Β
Younger adults are more accepting of someone using AI to generate non-consensual content: nearly one in four Gen Z (24%) and Millennials (23%) say itβs okay, compared with 13% of Gen X and just 5% of Boomers+Β
Men are also more permissive: more than one in five (22%) say itβs okay, compared with 14% of womenΒ
Attitudes toward the behavior may vary, but the fear of becoming a target is far more widespread. Overall, nearly two-thirds of people (62%) worry someone could create fake nude or sexually explicit photos or videos of them. Women feel this threat more acutely: nearly seven in ten (69%) are concerned, compared with 57% of men.Β
For some, this fear has already become a reality:Β Β
One in ten say AI has been used to generate nude or sexually explicit imagery of them without permissionΒ
One in ten say someone has threatened to release AI-generated compromising or explicit imagery of themΒ
As one respondent recounted:Β
βI had someone make fake nudes of me using AI on my photos from my social media and threaten to post them on Facebookβ¦[it] made me more cautious about AI.β
The intimate material may be fake, but the fear, coercion, and potential for reputational, emotional, and financial damage are completely real.Β
AI is making it harder to know who youβre really talking toΒ Β
The threat doesnβt stop with fabricated sexual content. AI is also making it harder to know whether the person on the other side of a screen is who they claim to be.Β
Humans have always edited themselves for other people. We choose the most flattering photo, write and rewrite the text before sending it, and present our most interesting selvesβespecially when forming new relationships. AI dramatically expands what that kind of self-editing can look like, and people arenβt shy about using it:Β
54% say AI helps them present the best version of themselvesΒ Β
47% say using AI to present your βbest selfβ to employers, friends, or romantic partners does not present a false identityΒ
That rises to 58% of both Gen Z and Millennials and 64% of regular AI usersΒ
But where does enhancement end and deception begin? Is an AI-polished dating profile still authentically you? What about a message you didnβt write? A photo that looks like you, only better?Β
Thereβs a flipside to using AI to make ourselves look or sound better: If we can do it, so can everyone else. And people are much less comfortable when theyβre not the ones controlling the technology. Two-thirds (67%) worry that an online friend or romantic interest could use AI-generated images, videos, or other content to deceive them.Β Β
Catfishing, fake photos, and lies on dating profiles arenβt new. AI just makes the deception easier. Someoneβs photos, backstory, messages, and even their voice can all be faked.Β Β
One person described leaving dating apps after realizing the person they were talking to had gone well beyond simply polishing their profile:Β
β[The] dating profile had fake picturesβ¦[it] wasnβt just making true events sound interesting and more flirty, but creating completely false photos and information. Left the dating apps again and needed to reset.β
AI can distort identity in the other direction, too. It can also create a version of us we never chose to put into the world.Β Β
76% worry about someone creating a fake profile pretending to be themΒ
70% worry about fake images or videos of themselves being createdΒ
71% worry AI-generated content could be used to damage their reputationΒ
Relationships are built on mutual trust. AI can distort both sides of the connection: who we think the other person is, and who they think we are.Β Β
AI is quietly finding its way into the space between peopleΒ Β
Not all of AIβs influence on intimacy is so dramatic. Much of it happens quietly, showing up in how people communicate with each other and navigate relationships:Β
More than one in three have used AI to help write or edit a messageΒ
About one in seven have turned to it for advice about a relationship or personal decisionΒ
One in ten say it has already changed how they date or communicate romanticallyβrising to nearly one in five among Gen ZΒ
The survey responses show what this looks like in real life. For example, one respondent described using AI with their partner as a way to step outside their own point of view:Β
βPersonally, it has helped me. We use AI in our relationship as a reflection tool, and it has sometimes helped us take on the perspective of the other.β
For another, AI helped them work through jealousy:Β Β
βSo, I used to accuse my partner, and I got really territorial about them but once I talked to AI about it, they gave helpful advice and now we are stronger than ever.β
AI is also showing up in other difficult relationship moments. One person said it helped them βstay calm and communicateβ when problems came up with their partner; another said it allows them βto pause and refine [their] thoughtsβ before responding.Β
Sometimes the role is simpler. One respondent said AI gives them βnew romantic wordsβ for their partner, while another said theyβve asked AI for advice on how to make their partner smile. AIβs growing role in relationships may be unsettling, but the benefits people describe are definitely there.Β
AI isnβt just helping people find the right words. Itβs also helping them decide what version of themselves to put forward in the first place. More than one in three say itβs okay to use AI to create or improve a dating profile; nearly two-thirds arenβt opposed. One respondent described using AI as a βcreative advisorβ to polish their profile and come up with conversation starters.Β
AI doesnβt have to replace a relationship to help shape it. It can influence how people communicate, what advice they take, and how they choose to present themselves.Β Β
AIβs intimacy problem is ultimately a trust problemΒ
From connection to deception to outright harm, the same question keeps surfacing: Can I trust whatβs in front of me? And would I know if I couldnβt?Β
Nearly nine in ten people (88%) say AI is making it harder to tell what online content is genuinely human or real. And 84% say even convincing video evidence no longer necessarily feels like proof. That uncertainty follows people into dating and relationships, where knowing whatβand whoβto trust is deeply personal.Β
AI may make it easier to start a conversation, smooth over a hard one, or feel connected when youβre lonely. But relationships and intimacy of all kinds still come down to trust, and AI is making that trust a little harder to take at face value.Β
About the researchΒ
The research in this article is based on a March 2026 survey about AI, identity, and the collapse of digital trust and was conducted among 1,500 respondents in the United States, United Kingdom, Germany, Austria, and Switzerland. The research was prepared by an independent research consultant and distributed via Forsta.Β
Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
The rapid diffusion of AI globally and the pace at which AI is developing put us at a societal crossroads. The choices weβre making now will determine who has access to AI and the opportunity it affords. There is perhaps no more important tool than our education systems for addressing the uneven diffusion of AI weβre seeing currently: national adoption runs above 70% in countries such as the United Arab Emirates and falls to low single digits across much of sub-Saharan Africa, close to a tenfold difference.Β
The way we teach AI and learn with it will have long-lasting impacts on jobs, the workforce, and our broader economy. Learning Curves: Rethinking Education from Classrooms to Careers in an AI-Driven World is a collection of research-driven essays that can help guide those choices. This book brings together the body of work from the second cohort of Senior Fellows from the Microsoft AI Economy Institute (AIEI), a flagship think tank that produces research and convenes experts to generate insights into how AI is reshaping work, education, and the broader economy.Β
In Learning Curves, researchers consider how AI is reshaping the earliest stages of learning and work, from Kβ12 classrooms and community and technical colleges to collegeβtoβwork transitions and entryβlevel jobs, and what it will take for that transformation to widen opportunity rather than deepen divides across institutions, communities, and countries. Β
Below, I share a few of my own reflections that informed my contributions to Learning Curves, a collaborative effort that wouldnβt have been possible without the truly talented, diverse cohort of researchers who contributed to this book.Β Β
The good, the bad, and the ugly: Laying the foundation for AI in Kβ12 classrooms
Before delving into the specifics of how to incorporate AI in classrooms, we need to ask ourselves whether weβre teaching for knowledge, or for learning.Β Β
The book, the calculator, the personal computer, the internet, the search engine, and the smartphone all arrived in classrooms carrying real promise alongside the worry that they would hollow out young minds. Usually the truth landed somewhere in between, and where it landed depended less on the tool than on the choices the adults made about how to use it.Β
The fact is that the AI-native generation is already here, and its members are in classrooms around the world. More than half of US teenagers already use AI chatbots for schoolwork. Iβve personally seen the promise of AI as a force for good in education up close in my own classroom, where I teach a computer science class to elementary school students. Β
But of course, the good is only part of the story. We canβt shy away from the downsides of incorporating AI into classrooms. While AI can help with accessibility and individualized learning, it can also create overβreliance, contribute to student cheating, or prevent students from recognizing when information may be false.Β
The rapid deployment of AI in Kβ12Β classrooms needs to come with a sober assessment of how that technology impacts all students. This assessment must go beyond the technology itself to encompass how students, teachers, parents, and society use AI. Β Β
AI literacy is only part of the solution
If classrooms are where students learn how to think, teachers are the conduit through which this learning happens. In Learning Curves, Joseph Orero, Senior Researcher in AI at Strathmore Universityβs School of Computing and Engineering Science, posits that teachers arenβt resistant to AI in classrooms; they just need proper training to help them adequately adapt and teach their students critical skills. His research contribution explores game-based learning with AI-enabled African languages.Β
AI usage and adoption worldwide are also dependent on accessibility. Another chapter of the book looks at barriers and opportunities in Arabic education and finds that the primary barrier teachers encountered when introducing AI writing assistants into classrooms was Arabic digital literacy, particularly studentsβ typing ability. Β
Researchers often circled around a similar theme: there is no one-size-fits-all approach to developing AI competency; instead, such an approach must be sensitive to local knowledge and contextualized teaching and learning practices. This means that teachers, in turn, must have training that makes sense for the unique contexts in which their students are learning. Β
Frank Nagle, now Microsoftβs Chief AI Economist, Sarah Rodriguez, Associate Professor of Engineering Education at Virginia Tech, and other researchers in Learning Curves make the case that, in many ways, nontraditional pathways such as apprenticeships and two-year-degree programs, particularly those that are virtual, are more nimble and thus better able to adapt their curricula to the rapidly changing field of AI. Β
AI Is taught in the classroom, but then what?
Education has never been about simply preparing people for the future of work so they can thrive in the labor market. When considered holistically, it is about teaching students not what to think but how to think. In our AI era, education is one of the core institutions through which the future of work will be built, distributed, and made more (or less) equitable. Successful AI integration remains human-centered by focusing on organizational change, durable human skills like empathy and judgment, strong employer partnerships, and learner needs.Β
As research from Laura Nuriski, Head of Program on the Future of Work at the Centre for European Policy Studies (CEPS), highlights, access to AI alone does not ensure successful integration. Technology transfer, data infrastructure, organizational readiness, and a human-centered approach to building and deploying AI are also key indicators of success. Β
Whether weβre talking about the classroom or the boardroom, itβs worth keeping in mind that AI tends to do the most good when it strengthens human capability and the most harm when it substitutes for it. That holds as true in a fourth-grade reading lesson as in a software team or a hospital ward.Β
The children in our schools deserve tools that serve their learning rather than stand in for it, and that is within our power to provide. Our most successful future with AI will be one that is human-centered, inclusive, and designed to help people thrive.Β
.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column480165_4ecc5f-ac{position:relative;}@media all and (max-width: 1024px){.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
In this article
Some Halloween AI video sites ask for personal photos without clearly identifying who runs them.
Outside AI providers may also receive your uploads.
Before uploading, check who gets your photos, how theyβre used, and when theyβre deleted.
This Halloween, AI is doing the costumes. Upload a photo and you can become a vampire, surround your dog with pumpkins, or star in a viral βzombie love story:β Your partner has turned, you lower the gun, and the zombieβs leap ends in a hug.
But before you upload, do you know who will receive your photos?
We found no malware or phishing on the sites we examined. What concerned us was how little we could establish about who operated them and who would be responsible for the photos people uploaded.
Polished, friendly, and anonymous
These sites look professional and sound reassuring. They promise privacy, have FAQs and refund policies, and some even add consent checkboxes for photos of children. One calls itself βan independent tool with no ties to TikTok or any film studio.β
What they donβt tell you is who is behind them. On the sites we checked, we found no company name, address, or named operator, only a support email on the siteβs own domain.
Where do your photos go?
These sites ask for clear, well-lit photos of you, your partner, your friends, your pets, and, with a parentβs permission, your children.
The sites we looked at say they rely on outside AI providers to generate the videos. That means youβre trusting both the website collecting your photos and the providers processing them.
Wherever you upload photos, check who can access them and how they can be used. Scammers can use someoneβs likeness to create fake intimate images and demand money to keep them private. In our Face Value report, 10% of respondents said someone had threatened to release AI-generated explicit content of them. We found no evidence of that happening through these Halloween sites, but itβs a reason to be careful where you share your photos.
The sites promise to delete uploads within days, and we have no evidence that they fail to do so. But we couldnβt independently verify those promises. Without an identifiable operator, itβs harder to establish who is accountable for handling your photos and responding to deletion requests.
Google sign-in doesnβt identify everyone handling your photos
These sites use the real Google sign-in window, so you type your password into Google, not the video site. But using Google to sign in doesnβt mean Google endorses the service or guarantees its privacy promises.
Click the app name in Googleβs sign-in window and youβll see Developer info. On one site we checked, the only contact listed was a Gmail address. We saw the same with the September sites. A Gmail address alone doesnβt establish wrongdoing, but it does little to identify the operator.
On another, Google said you were signing in βto continue toΒ neon.tech.β Neon is a legitimate database company and authentication service provider. Its name appearing here doesnβt mean it operates or endorses the Halloween video site.
Login providers can handle Google sign-in on a siteβs behalf. Depending on the setup, Google may display the providerβs domain instead of the video siteβs name. Here, the sign-in screen gave visitors no clear indication of who operated the Halloween service.
Built from a kit, recycled for the next trend
Sites like these donβt necessarily take a team or months of work. Some use the same $249 website kit we wrote about in September, which promises you can βlaunch your AI product in one hour.β On one Halloween site, the builders hadnβt even cleared out the kitβs sample content. Hidden in the page was a note saying it was βa demo siteβ for the template, along with placeholder links like βyour-app-name.β
Another siteβs code contained remnants of an AI rap and dance video maker, including a βhotel lobbyβ stage, a recording studio, and AI-written raps. Those remnants suggest the site uses code also intended for other AI video services.
Using a website kit isnβt itself suspicious. But a polished page can be quick to assemble, so its appearance tells you little about the business handling your photos.
Take your time before paying, too
On one site, a single 15-second zombie clip cost $9.99. The pricing page nudged visitors toward bigger packs, bringing the advertised price per video down to $2.99. But that lowest price meant spending $199 on enough credits for roughly 66 zombie films. There were monthly and yearly plans too, costing up to $600 a year.
One site also used countdown offers, reminders in the browser tab, and claims about how many people had made films that day to encourage visitors to buy.
Thereβs no need to rush. Check the payment terms as carefully as the privacy policy. The sites themselves warn that AI can change faces, so your video may not look much like you. Under the policies we reviewed, credits are returned if a video fails to generate. But if you simply donβt like the result, trying again costs more credits.
Subscriptions renew until you cancel, yearly plans are charged in one go, and some credits expire before you use them.
What to check before uploading your photos
Whichever tool or platform you choose, make sure youβre comfortable with how it will handle your data, your photos, and your payment info.
Find out who runs the service. Look for a named operator and clear contact details. If you canβt establish who would be responsible for your photos, consider another service.
Check where your photos go. Read the privacy policy for information about outside AI providers, retention periods, and whether uploads can be used for AI training.
Look for a deletion process. Check how to request deletion and whether the policy explains what happens to copies held by outside providers.
Be especially careful with childrenβs photos. A parental consent checkbox doesnβt explain how a service will protect them. Only upload other peopleβs photos with their permission.
Read Googleβs sign-in window. Check the developer details and any permissions requested. Google sign-in doesnβt replace checking the service itself.
Ignore countdowns and check payment terms. Take time to understand the full cost, credit expiry, and whether your purchase starts a subscription.
Review your Google connections afterward. Remove services you no longer use from your Google accountβs third-party connections. This doesnβt cancel subscriptions or delete photos or other data already held by the service.
But these tools canβt verify a serviceβs photo deletion promises. You should still check who operates it and what its privacy terms say before uploading.
.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{background-color:#ffe5e5;}.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column480165_4ecc5f-ac{position:relative;}@media all and (max-width: 1024px){.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column480165_4ecc5f-ac > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
In this article
Some Halloween AI video sites ask for personal photos without clearly identifying who runs them.
Outside AI providers may also receive your uploads.
Before uploading, check who gets your photos, how theyβre used, and when theyβre deleted.
This Halloween, AI is doing the costumes. Upload a photo and you can become a vampire, surround your dog with pumpkins, or star in a viral βzombie love story:β Your partner has turned, you lower the gun, and the zombieβs leap ends in a hug.
But before you upload, do you know who will receive your photos?
We found no malware or phishing on the sites we examined. What concerned us was how little we could establish about who operated them and who would be responsible for the photos people uploaded.
Polished, friendly, and anonymous
These sites look professional and sound reassuring. They promise privacy, have FAQs and refund policies, and some even add consent checkboxes for photos of children. One calls itself βan independent tool with no ties to TikTok or any film studio.β
What they donβt tell you is who is behind them. On the sites we checked, we found no company name, address, or named operator, only a support email on the siteβs own domain.
Where do your photos go?
These sites ask for clear, well-lit photos of you, your partner, your friends, your pets, and, with a parentβs permission, your children.
The sites we looked at say they rely on outside AI providers to generate the videos. That means youβre trusting both the website collecting your photos and the providers processing them.
Wherever you upload photos, check who can access them and how they can be used. Scammers can use someoneβs likeness to create fake intimate images and demand money to keep them private. In our Face Value report, 10% of respondents said someone had threatened to release AI-generated explicit content of them. We found no evidence of that happening through these Halloween sites, but itβs a reason to be careful where you share your photos.
The sites promise to delete uploads within days, and we have no evidence that they fail to do so. But we couldnβt independently verify those promises. Without an identifiable operator, itβs harder to establish who is accountable for handling your photos and responding to deletion requests.
Google sign-in doesnβt identify everyone handling your photos
These sites use the real Google sign-in window, so you type your password into Google, not the video site. But using Google to sign in doesnβt mean Google endorses the service or guarantees its privacy promises.
Click the app name in Googleβs sign-in window and youβll see Developer info. On one site we checked, the only contact listed was a Gmail address. We saw the same with the September sites. A Gmail address alone doesnβt establish wrongdoing, but it does little to identify the operator.
On another, Google said you were signing in βto continue toΒ neon.tech.β Neon is a legitimate database company and authentication service provider. Its name appearing here doesnβt mean it operates or endorses the Halloween video site.
Login providers can handle Google sign-in on a siteβs behalf. Depending on the setup, Google may display the providerβs domain instead of the video siteβs name. Here, the sign-in screen gave visitors no clear indication of who operated the Halloween service.
Built from a kit, recycled for the next trend
Sites like these donβt necessarily take a team or months of work. Some use the same $249 website kit we wrote about in September, which promises you can βlaunch your AI product in one hour.β On one Halloween site, the builders hadnβt even cleared out the kitβs sample content. Hidden in the page was a note saying it was βa demo siteβ for the template, along with placeholder links like βyour-app-name.β
Another siteβs code contained remnants of an AI rap and dance video maker, including a βhotel lobbyβ stage, a recording studio, and AI-written raps. Those remnants suggest the site uses code also intended for other AI video services.
Using a website kit isnβt itself suspicious. But a polished page can be quick to assemble, so its appearance tells you little about the business handling your photos.
Take your time before paying, too
On one site, a single 15-second zombie clip cost $9.99. The pricing page nudged visitors toward bigger packs, bringing the advertised price per video down to $2.99. But that lowest price meant spending $199 on enough credits for roughly 66 zombie films. There were monthly and yearly plans too, costing up to $600 a year.
One site also used countdown offers, reminders in the browser tab, and claims about how many people had made films that day to encourage visitors to buy.
Thereβs no need to rush. Check the payment terms as carefully as the privacy policy. The sites themselves warn that AI can change faces, so your video may not look much like you. Under the policies we reviewed, credits are returned if a video fails to generate. But if you simply donβt like the result, trying again costs more credits.
Subscriptions renew until you cancel, yearly plans are charged in one go, and some credits expire before you use them.
What to check before uploading your photos
Whichever tool or platform you choose, make sure youβre comfortable with how it will handle your data, your photos, and your payment info.
Find out who runs the service. Look for a named operator and clear contact details. If you canβt establish who would be responsible for your photos, consider another service.
Check where your photos go. Read the privacy policy for information about outside AI providers, retention periods, and whether uploads can be used for AI training.
Look for a deletion process. Check how to request deletion and whether the policy explains what happens to copies held by outside providers.
Be especially careful with childrenβs photos. A parental consent checkbox doesnβt explain how a service will protect them. Only upload other peopleβs photos with their permission.
Read Googleβs sign-in window. Check the developer details and any permissions requested. Google sign-in doesnβt replace checking the service itself.
Ignore countdowns and check payment terms. Take time to understand the full cost, credit expiry, and whether your purchase starts a subscription.
Review your Google connections afterward. Remove services you no longer use from your Google accountβs third-party connections. This doesnβt cancel subscriptions or delete photos or other data already held by the service.
But these tools canβt verify a serviceβs photo deletion promises. You should still check who operates it and what its privacy terms say before uploading.
AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the userβs privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security teamβs oversight or well-designed policies.
Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles.
First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules.
You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints.
Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Letβs take a closer look at these solutions and technologies.
Popular AI applications and services in organizations
Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendorsβ products installed at the time of the study.
#
AI product
1
Claude
2
Claude Code
3
Codex
4
OpenCode
5
Zed
6
Wispr Flow
7
LM Studio
8
ZCode
9
Chatbox
10
Cherry Studio
The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow).
According to open sources, these are the most widely used AI services in 2026:
Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025β2026 (download)
* Data for previous quarters was updated and may differ slightly from previously published data.
Application Control and Web Control
To enforce the organizationβs security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization.
Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use.
This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees.
Here is what this functionality looks like to KSC administrators:
KL categories available when configuring Application Control
For details on how to configure Application Control in KSC, follow this link.
In Kaspersky Endpoint Security (KES), Application Control can operate in two modes:
Denylist. In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode.
Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules.
Below are the steps to configure Application Control to block AI tools.
Configuring Application Control for the AI Tools category in KES
With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesnβt start.
KES notification about an attempt to launch an AI agent
The View applications drop-down list shows products for a specific vendor.
Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning.
KES notification about an attempt to access a prohibited web resource
When configuring access, the administrator can block websites that provide AI as a service.
Website categories
For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control.
Kaspersky Endpoint Detection and Response
To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesnβt fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity.
Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events.
For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device.
In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task.
We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys.
The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation.
The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the userβs data.
The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way.
Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API.
The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix:
AI agent profiles on Kaspersky TIP
The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for.
Claude profile on Kaspersky TIP
The description also lists ways to detect the software through standard system auditing mechanisms:
Windows: events from standard audit logs and Sysmon events
Linux: syscall audit events and Sysmon events
Network auditing: a set of protocols and the traffic generated by the software
The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts.
Detection section in the Claude profile
Hunt Hub
In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand.
This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups.
In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents.
Rules in the Hunt Hub repository
The rule card provides:
Detailed description
Ruleβs severity level, confidence level, and alert format
Detection tips
Description of possible false positives
Platforms the rule can run on
Tactics, techniques, and sub-techniques covered by the rule
Groups that use the technique covered by the rule
Detection logic that shows what exactly triggers the rule
Detection rule card in Hunt Hub
Kaspersky Scan Engine
Skills are a key component of the AI agent ecosystem. Theyβre prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents.
Detection of a malicious agent skill in Kaspersky Scan Engine
Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so itβs critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size.
Detection of an LLM with malicious code in Kaspersky Scan Engine
Conclusion
AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this:
Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity.
Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host.
Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources.
Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs.
When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the userβs privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security teamβs oversight or well-designed policies.
Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles.
First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules.
You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints.
Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Letβs take a closer look at these solutions and technologies.
Popular AI applications and services in organizations
Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendorsβ products installed at the time of the study.
#
AI product
1
Claude
2
Claude Code
3
Codex
4
OpenCode
5
Zed
6
Wispr Flow
7
LM Studio
8
ZCode
9
Chatbox
10
Cherry Studio
The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow).
According to open sources, these are the most widely used AI services in 2026:
Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025β2026 (download)
* Data for previous quarters was updated and may differ slightly from previously published data.
Application Control and Web Control
To enforce the organizationβs security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization.
Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use.
This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees.
Here is what this functionality looks like to KSC administrators:
KL categories available when configuring Application Control
For details on how to configure Application Control in KSC, follow this link.
In Kaspersky Endpoint Security (KES), Application Control can operate in two modes:
Denylist. In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode.
Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules.
Below are the steps to configure Application Control to block AI tools.
Configuring Application Control for the AI Tools category in KES
With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesnβt start.
KES notification about an attempt to launch an AI agent
The View applications drop-down list shows products for a specific vendor.
Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning.
KES notification about an attempt to access a prohibited web resource
When configuring access, the administrator can block websites that provide AI as a service.
Website categories
For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control.
Kaspersky Endpoint Detection and Response
To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesnβt fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity.
Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events.
For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device.
In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task.
We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys.
The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation.
The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the userβs data.
The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way.
Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the ai_agent_**_execution rules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API.
The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the ai_ prefix:
AI agent profiles on Kaspersky TIP
The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for.
Claude profile on Kaspersky TIP
The description also lists ways to detect the software through standard system auditing mechanisms:
Windows: events from standard audit logs and Sysmon events
Linux: syscall audit events and Sysmon events
Network auditing: a set of protocols and the traffic generated by the software
The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts.
Detection section in the Claude profile
Hunt Hub
In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand.
This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups.
In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents.
Rules in the Hunt Hub repository
The rule card provides:
Detailed description
Ruleβs severity level, confidence level, and alert format
Detection tips
Description of possible false positives
Platforms the rule can run on
Tactics, techniques, and sub-techniques covered by the rule
Groups that use the technique covered by the rule
Detection logic that shows what exactly triggers the rule
Detection rule card in Hunt Hub
Kaspersky Scan Engine
Skills are a key component of the AI agent ecosystem. Theyβre prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents.
Detection of a malicious agent skill in Kaspersky Scan Engine
Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so itβs critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size.
Detection of an LLM with malicious code in Kaspersky Scan Engine
Conclusion
AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this:
Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity.
Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host.
Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources.
Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs.
When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
In the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. The figure reflects AIβs growing presence across the cybercriminal underground, where adversaries are using new capabilities to accelerate attacks and develop malicious tooling with fewer resources.
For enterprise defenders, these developments are adding pressure to threat intelligence programs already managing high alert volumes, limited analyst capacity, and expanding responsibilities.
Missed the live webinar? Weβve rounded up the key takeaways below, and the full session is now available to watch on demand.
AI Is Changing the Economics and Speed of Cybercrime
AI is helping threat actors develop capabilities and execute attacks faster, reducing the time and expertise required for activities that previously demanded greater resources.
Several developments illustrate the broader shift in cybercrime economics and attack velocity:
Initial access costs have declined by approximately 69%, reflecting the continued commoditization of access to compromised environments.
Attackers published 637 malicious package versions in just 22 minutes during a software supply chain compromise.
Nearly one in five vulnerabilities disclosed during the first half of this year had public or functional exploit code available, narrowing the window for defenders to address exposed systems.
AI is primarily accelerating established techniques, particularly during the early stages of the attack chain, including reconnaissance, social engineering, vulnerability discovery, and exploitation.
For defenders, this creates an opportunity to identify and disrupt malicious activity during its preparation stages. However, it also raises expectations around how quickly intelligence teams can recognize emerging threats, prioritize relevant findings, and act before an attack progresses.
AI Is Changing How Cybercriminals Develop Tools and Share Knowledge
AI is also changing how threat actors acquire the skills and capabilities needed to carry out attacks, creating new challenges for intelligence collection.
Historically, underground communities enabled cybercriminals to collaborate, exchange expertise, and obtain specialized services. Increasingly, threat actors can use AI to troubleshoot code, develop malicious tooling, and learn unfamiliar techniques independently, reducing their reliance on public collaboration.
βNo longer do they need a community to build up their skills like they previously had. So weβll see less of the development, and what we do see is a finished tool showing up for sale.β
Ian GrayVP of Intelligence, Flashpoint
Reduced activity in underground communities does not necessarily mean cybercriminal activity is declining. While forums, encrypted messaging platforms, and other illicit communities remain important intelligence sources, collection strategies must account for changes in how and where adversaries develop and distribute their capabilities.
Threat Intelligence Teams Are Struggling to Keep Up with Growing Demands
As adversaries accelerate their operations, enterprise threat intelligence teams are contending with growing workloads and limited resources.
Independent research commissioned by Flashpoint surveying threat intelligence budget owners and influencers at large North American enterprises identified several leading operational challenges:
65% cited alert noise and false positives.
55% identified analyst bandwidth and effectiveness.
50% pointed to the evolving threat landscape.
50% cited tool integration and interoperability challenges.
Note: Respondents could select up to three challenges.
High alert volumes, disconnected systems, and manual investigations consume analyst time that could otherwise be spent addressing emerging threats.
As one healthcare threat intelligence leader explained:
βGood analysts take time to develop and train, and we canβt hire our way out of that problem.β
These challenges are prompting organizations to examine how they can improve existing workflows, reduce repetitive investigations, and make better use of analyst expertise.
Threat Intelligence Budgets Are Growing, with AI Threats Leading Investment Priorities
Despite operational pressures, organizations are continuing to invest in threat intelligence.
Flashpointβs research found that 50% of respondents expect their threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of at least 10%. Another 40% expect budgets to remain essentially flat, while 0% anticipate a decrease.
AI-related threats emerged as the leading priority for expanded intelligence coverage, particularly:
Deepfakes and synthetic media, including their use in impersonation, fraud, and social engineering.
AI-accelerated vulnerability exploitation, as adversaries identify and exploit weaknesses more quickly.
Emerging AI-enabled attack vectors, including changes in threat actor tactics, techniques, and procedures.
Organizations are also investing in additional intelligence feeds, expanded security use cases, and further development of their intelligence programs.
These priorities reinforce the importance of translating AI-related threats into specific intelligence requirements aligned with organizational risk.
Agentic AI Adoption Is Underway, but Trust and Measurable Value Remain Essential
Alongside investments in AI-related threat coverage, organizations are exploring how agentic AI can improve their own intelligence operations.
Flashpointβs research found that:
25% are already using agentic AI in production.
20% are piloting agentic AI or conducting proofs of concept.
35% are planning adoption within the next 12 to 24 months.
20% are taking a wait-and-see approach.
Early implementations focus primarily on information retrieval, alert prioritization, contextual enrichment, intelligence platform queries, and MITRE ATT&CK mapping.
Organizations remain more cautious about granting agents autonomy over consequential actions, such as blocking IP addresses or changing security controls.
One research participant captured the concern:
βAn agent thatβs confidently wrong is worse than one thatβs slow.β
Accuracy, data privacy, auditability, predictable costs, and human oversight remain central considerations. Organizations also expect AI investments to demonstrate measurable value through time savings, improved efficiency, and faster response.
βWeβre out of the phase of treating AI as inherently good and giving it a blank check. Now, itβs about figuring out how to make it work within existing teams, workflows, and priority intelligence requirements.β
Joe Sawyer Chief Market Officer, Flashpoint
Preparing Your Threat Intelligence Strategy for 2027
As organizations prepare for 2027, four priorities can help guide threat intelligence planning:
Plan for threats you cannot readily observe. Identify potential gaps in intelligence collection and examine emerging attack methods, including weaknesses in internal security processes.
Prepare for machine-speed attacks. Evaluate detection, prioritization, and response capabilities against increasingly compressed attack timelines.
Turn AI threats into actionable intelligence requirements. Map emerging techniques to relevant adversaries, established frameworks, defensive controls, and business risks.
Use agentic AI where it can extend analyst capacity. Prioritize repeatable workflows that deliver measurable value while maintaining appropriate data controls and human oversight.
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.
Image: Shutterstock.com, Sashkin.
The flaws at issue are present in PHP, the programming language that powers sites running on a large number of web publishing systems, including Drupal, Magento, Joomla and WordPress. Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server.
Reutersreports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed. Cloudflare said it has already detected some exploitation of the flaw, and that at 3:02 am (UTC) it implemented web application firewall rules to protect websites from attack traffic seeking to exploit the bugs, which could cause a denial of service condition, remote code execution, and data exposure.
OpenAI, which was involved in the vulnerability research and outreach, said βgiven the severity of these flaws and PHPβs widespread use, we consider this one of the most impactful security issues in recent memory.β
Censys, a company that tracks the technology used by Internet hosts, said a recent scan identified approximately 2.58 million Internet facing hosts and 54.9 million web properties running PHP.
Security experts at Wiz said every PHP version released in the last decade is affected by at least one of these vulnerabilities [full disclosure: Wiz is an advertiser on this blog].
βThese findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,β reads a blog post published today by a team of researchers at Wiz, which was one of several organizations credited with discovering the vulnerabilities. βThe underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.β
The Wiz researchers say it is likely the PHP vulnerabilities will be mass-exploited to install web-based backdoors or βweb shells,β which give attackers a web-based panel that allows them to remotely control infected sites. Wiz said that prior to the PHP bugs being publicly disclosed, the company worked with the PHP team, Calif and OpenAI to measure the size of the problem and coordinate patch verification and disclosure.
The PHP zero-day vulnerabilities are being tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP 5.4 or later. The bugs are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
According to Wiz, PHP is so deeply embedded in many web applications that we are likely to see organizations struggling to patch these vulnerabilities for some time to come, comparing this PHP vulnerability pair with the Log4Shell weakness that emerged in 2021 β a widespread, severe-as-it-gets security flaw in Log4j, a popular Java logging framework.
βA vulnerability in core PHP reaches far beyond a single application,β the Wiz researchers wrote. βPHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem.β
The SANS Internet Storm Center is keeping an eye on major software platforms that are shipping updates to deal with these PHP flaws. For example, Ubuntu just released updated PHP packages. For a technical deep-dive on these vulnerabilities that tells the timeline of the discovery of these bugs in a comic book style, check out this post from Calif, another technology company credited with finding the PHP flaws.
A snapshot of php2shell.censys.com, the website Censys set up to track the PHP vulnerabilities.
This is a fast-moving story. Updates will be noted here with timestamps.
Update, 2:30 pm ET: Add figures from Censys and a link to Califβs writeup.
Login
