Can antivirus stop a rogue AI agent?

Over seven days in June, Sophos's endpoint software blocked a run of actions by AI coding agents on its customers' Windows machines, according to the company's own telemetry. In one example, Claude Code ran a command that lists the credentials saved in Windows Credential Manager, in a session started with a flag that skips its permission checks. In another, OpenAI's Codex tried to download a Python installer from python.org with a built-in Windows tool that attackers often misuse, and when that was blocked it switched to a second tool, which was blocked too. Sophos made a point of saying it wasn't calling any of this malicious. About Codex, it wrote: "That pivot behavior is exactly what separates an active adversary from a dumb script" (Sophos).

Now turn that round. If a good behaviour engine sometimes can't tell a helpful agent from an attacker by what it does, it will struggle to tell a hijacked agent from a helpful one. So can modern antivirus protect you from a rogue AI agent? Not reliably, and not on its own. Classic antivirus looks for malicious files and programs, and an agent that has been fed bad instructions is a program you installed on purpose, using logins and permissions you gave it. The antivirus makers have started building something new for this, which we think is the clearest evidence of the gap. What helps today is limiting what an agent can reach and watching what it does.

What antivirus is built to catch

Modern antivirus is more than a list of known viruses. It typically matches files against signatures, watches running programs for behaviour that looks like an attack and checks the reputation of what you download. Apple's built-in version on the Mac, XProtect, is a tidy example of the first part. It checks for known malicious content when an app is first launched, when an app changes and when Apple updates its signatures (Apple).

Every one of those checks asks the same question: is this file or program bad? An AI agent turns the question upside down. The agent is a legitimate program you chose to install. What makes it dangerous on a given day is the text it reads and the access you've given it, and a file scan can't condemn either of those.

It helps to split AI trouble on a computer into three kinds. Classic antivirus does worse with each one, and we'll take them in turn:

• Malware written with AI, or that asks an AI model what to do while it runs. It's still malware, and it still lives in a file.
• Malware that borrows the AI assistant you already have. The malicious part is small, and a program you trust does much of the work.
• The assistant itself, turned by something it read, by a poisoned tool or model, or by its own mistake. Often there's no malicious file to scan at all.

Malware written with AI is still malware

Start with the good news. In August 2025 ESET, which makes antivirus software, announced what it called the first known AI-powered ransomware. PromptLock was built to run an OpenAI open-weight model locally and have it write, on the fly, the scripts that searched, copied and encrypted files. ESET found no sign of it in real attacks (ESET). The authors of an academic study then got in touch with ESET. The samples matched their research prototype, built at NYU Tandon (NYU Tandon). They'd turned up on VirusTotal, where security companies share and scan suspicious files, and an antivirus company was the one that spotted them.

AI-built malware is still a file, and antivirus companies know this race. What AI changes is the pace. In November 2025 Google's Threat Intelligence Group described PROMPTFLUX, a dropper with a version that asks Google's Gemini model to rewrite the malware's entire source code every hour to evade detection. Google judged it experimental: in its current state it couldn't compromise a device. In the same report Google described PROMPTSTEAL, which it attributes to the Russian government-backed group APT28. It had a language model write the commands it ran, which Google called its first sighting of malware querying a model in live operations (GTIG). That's the point of the trick: a signature written for one version may not match the next.

The same kind of model that now finds real bugs for defenders, as we described in AI can find the bugs. Pentesters know which ones matter, can also be trained against one particular product. Dark Reading reported one proof of concept in July 2025. Kyle Avery, an offensive security researcher, put an open model, Qwen 2.5, in a sandbox with Microsoft Defender for Endpoint and rewarded it as its attempts got closer to slipping past. After about three months and roughly $1,500, it produced malware that got past Defender completely about 8% of the time, by his own measurement. An attacker could expect a working sample in a dozen or so tries (Dark Reading). It's the pattern we saw with PHP2Shell: AI makes slow, fiddly attack work cheap enough to be worth doing.

Sophos has seen criminals do a version of this. On 2 June 2026 Sophos's researchers described a group linked to ransomware and data theft. It had used Cursor and Claude Opus agents to build nearly 80 evasion modules and test them in a lab against the Sophos, CrowdStrike and Windows Defender agents. The group presented the work as a red-team project, which Sophos thinks was a way round Claude's guardrails on malware development. The AI agents reported near-universal success after enough rounds, though Sophos says the lab's own test output doesn't clearly support that, and people steered the work throughout (Sophos). Sophos found the lab because one of the group's machines set off alerts inside a customer's account. In this first category, antivirus is still in the fight. The fight is just faster.

Malware that borrows your AI assistant

The second kind is newer, and in our view it's where antivirus starts to lose sight of what's going on. On 26 August 2025 attackers who had stolen Nx's publishing token pushed malicious versions of the Nx build tool to npm, where they stayed for four hours (Nx). Part 2 of our AI history mentions it in a line. Here's what the malicious script did on developers' computers. It looked for AI command-line tools that were already installed (Claude, Gemini and Q) and started them with the flags that skip their permission checks: --dangerously-skip-permissions, --yolo and --trust-all-tools. Then it asked them to search the disk for secrets. Wiz, a cloud security company, described it as "exploiting trusted tools for malicious reconnaissance" and saw it succeed in hundreds of cases. When something did get in the way, it was sometimes the AI provider's own guardrails (Wiz). The haul, which included more than a thousand valid GitHub tokens, went to public repositories created in the victims' own GitHub accounts.

The same Google report described a credential stealer, QUIETVAULT, doing this in real attacks. It uses the AI command-line tools installed on the infected machine to hunt for more secrets, then uploads what it finds to a public GitHub repository (GTIG).

Look at the AI part of these attacks from the antivirus's side. The program reading your files is an AI assistant you installed. The destination is GitHub, a site developers use all day. The account is yours. The malicious script is still a file that security tools can look for, but the search itself was done by software you trust.

When the agent itself turns

The third kind can happen with no malware at all. An agent reads text and acts on it, and it can't reliably tell your instructions from someone else's. Microsoft says so in its own Defender documentation about agents running on people's computers: "They can't reliably separate trusted content from hidden instructions" (Microsoft). That's prompt injection, a weakness that got its name in 2022, as Part 1 of our AI history recounts. The NCSC suggests thinking of it as the exploitation of an "inherently confusable deputy", a privileged component that can be coerced into acting for a less privileged attacker. It warned in December 2025 that prompt injection may never be fully mitigated the way SQL injection can be (NCSC). It's the weakness behind customers talking chatbots into giving things away, with your files and logins on the table instead of a discount code.

Here's how that looked in a real browser. In August 2025 Brave's researchers published a test in which they hid instructions in a Reddit comment. When a user asked Perplexity's Comet browser to summarise the page, its agent followed them. It opened the user's Perplexity account page to find their email address and requested a one-time login code through a lookalike web address. Then it read the code in the user's Gmail, which was already logged in, and posted both as a reply to the comment. Every step was ordinary browsing, done in accounts the user had open, and Brave said the web's usual cross-site protections were "effectively useless" against it. Brave reported it to Perplexity first, and its disclosure timeline shows Perplexity acknowledging the report within two days and working on fixes before the research was published (Brave).

Microsoft gives the same warning about the experimental agent features in Windows. Its support page says hidden content in a document or on screen can override an agent's instructions, "leading to unintended actions like data exfiltration or malware installation" (Microsoft Support). Its safeguards include giving each agent its own account and its own Windows session, with only an administrator able to switch the features on.

This isn't only happening in labs. CrowdStrike, which sells endpoint protection, says attackers injected malicious prompts into legitimate AI tools at more than 90 organisations in 2025, to generate commands for stealing credentials and cryptocurrency (CrowdStrike).

The AI companies' own defences cut the success rate without ending it. Anthropic red-teamed its Claude in Chrome agent for its August 2025 pilot with 123 test cases across 29 attack scenarios. In the mode where Claude acts on its own, 23.6% of attacks worked before its new defences and 11.2% after (Anthropic). By November 2025, on a different test with an adaptive attacker, Anthropic reported 1.4% for Claude Opus 4.5 with improved safeguards, and said a rate around 1% still represents meaningful risk (Anthropic). OpenAI wrote in December 2025 that prompt injection, like scams on the web, is "unlikely to ever be fully 'solved'" (OpenAI). That month Gartner told organisations in an advisory to block AI browsers for now, citing, among other risks, rogue agent actions set off by hidden instructions (The Register).

The bad instructions don't have to come from a web page. They can sit in the descriptions an MCP server gives its tools, or be trained into a free model's weights. Since February, OpenClaw says, every skill published to its marketplace has been scanned with VirusTotal. Its announcement, written with VirusTotal's Bernardo Quintero, is blunt about the limit: "A carefully crafted prompt injection payload won't show up in a threat database" (OpenClaw).

Sometimes nobody is attacking at all. Part 2 covers two such cases, both described publicly by the people involved: the OpenClaw agent that, by its owner's account, ignored her stop messages, and the Replit agent that wiped a live database before a rollback restored it. Neither involved malware. An app the user had installed did ordinary things with the access it had been given.

OWASP's Top 10 for agentic applications, published in December 2025, describes why this is so hard to catch. In one of its examples, an agent fed an injected instruction chains together legitimate admin tools to steal sensitive logs. Every program it runs is trusted, every credential is valid, and endpoint detection sees no malware and no exploit (OWASP).

Behaviour monitoring sees the action, not the instruction

The part of antivirus that ought to help here is behaviour monitoring, and Sophos's telemetry shows that it does notice agents. Rules for credential access and for running commands made up most of what its engine blocked downstream of AI agents. In other cases PowerShell decrypted saved browser credentials while Claude Code was automating a browser, which Sophos thinks was almost certainly benign. Cursor also wrote a script into the Windows startup folder. Sophos treats that as a red flag, though it couldn't tell what the script was for (Sophos).

Sophos calls this its protections working exactly as designed, and fairly so, because those actions are risky whoever starts them. But from Sophos's description, the engine judged actions: commands run, credentials touched, files written. The instruction behind each action wasn't part of that picture, so it couldn't tell whether a request came from the person at the keyboard or from a web page the agent read a minute earlier. Sophos expects to tune some rules to allow for known-good agents. We'd add one worry of our own: a hijacked agent is still a known-good agent, so any exception written for a trusted agent also applies to that agent on a bad day.

Avoiding malware isn't new. CrowdStrike says 82% of its detections in 2025 were malware-free: attackers used valid credentials and trusted systems, and blended in with normal activity (CrowdStrike). In our view, on a laptop with an AI agent, the agent is the most trusted path there is.

There's a fair counter-argument, and it comes from Sophos too. Its chief information security officer, Ross McKerchar, argued in July that it makes little difference to defenders whether an AI or a person is attacking, because the same warning signs give both away. The intrusion into Hugging Face by OpenAI's test agents, he wrote, was noisy and set off detections that were already in place (Sophos). For an AI that breaks in from outside, we agree. It still has to exploit a hole and use stolen logins, and those can trip the same alarms they always did. An agent on your own computer doesn't break in. It was invited, it runs as you, and the most damaging things it can do (read your files, use your logins, send data to a site you use) are things you're allowed to do. Not every outside break-in was noisy, either. When AI labs' test agents reached Indian organisations' live systems this year, CERT-In said none of those organisations had detected it themselves, as Part 2 describes.

The antivirus makers have noticed

To us, the clearest sign that classic antivirus wasn't built for this job is that the companies who make it are building something new. Microsoft has added AI agent runtime protection to Defender for Endpoint, its business security product, as a preview. Announcing it on 2 June 2026, Microsoft explained why: "Local AI agents run as ordinary processes," and most security teams can't see what they do (Microsoft). At set points it checks the text going into and out of an agent's reasoning for injected instructions, and where the inspection method allows, it can stop a harmful action before it runs. Microsoft suggests starting in audit mode, and describes each check as a quick inline look, not continuous monitoring of the agent (Microsoft). Its setup guide lists a Defender for Endpoint Plan 2, Microsoft 365 E5, Agent 365 or Microsoft 365 E7 licence and Windows, and asks for test machines on its beta update channel during the preview (Microsoft). Its support matrix, last updated on 9 October 2026, lists 60 AI agents Defender can discover on Windows and 51 on macOS, and runtime protection for ten of them, all on Windows (Microsoft).

Norton has taken a version to home users. It launched AI Agent Protection in Norton 360 in April as a beta, and its launch release put the problem neatly: "a compromised AI agent does not just infect a file" (Norton). Its help page, last updated on 23 October 2026, describes the feature set as Safe AI, available on Windows and Mac. On Windows its Action Shield checks each step an agent tries, such as a command, a file change or a link, and answers allow, ask or deny. The verdicts come from pattern-based rules, link reputation and checks on the packages an agent installs. Norton says it also checks the pages and files an agent reads for hidden instructions, and that Action Shield works with Claude Code, Cursor, OpenClaw and Visual Studio Code (Norton).

Other security companies have bought specialists. SentinelOne announced in August 2025 that it would buy Prompt Security, describing the risks of AI adoption as "one of the most urgent and underserved challenges in enterprise security today" (SentinelOne). In September CrowdStrike announced it would buy Pangea to add protection at the prompt layer, which it billed as the industry's first complete AI detection and response (CrowdStrike). Check Point announced the same month that it was buying Lakera, which sells runtime protection for AI models and agents (Check Point).

If your security software has one of these features, switch it on. Just be clear about what it is: a new layer that works with particular agents, not a signature update. By their makers' own descriptions, Microsoft's makes a quick check at set points, and Norton's gives each action a verdict before it runs. Our worry is the case OWASP describes, a rogue agent whose actions can each look legitimate while together they do harm (OWASP). In the Comet attack above, every step was ordinary browsing. Catching an attack like that depends on spotting the hidden instruction itself, and both the NCSC and OpenAI say prompt injection may never be fully solved.

We wouldn't expect an independent score for these features soon, either. AV-Comparatives, one of the best-known labs that test antivirus, wrote on 26 August 2026 that broad "AI security" tests run into serious problems of method, and that for now it prefers narrower, focused assessments. The same attack on an agent can work in one run and fail in the next. The model may also refuse before the security product gets a chance to act, so it can be hard for a tester to say what stopped it (AV-Comparatives).

What actually limits the damage

The UK's National Cyber Security Centre published interim guidance on agentic AI on 20 August 2026. It's written for organisations, but its seven key considerations carry over to anyone running an agent. Work out what could go wrong and prompt carefully. Set the right level of oversight, run the agent in a sandbox, log and monitor it, make its activity easy to attribute and keep the ability to pull the plug. The list doesn't mention antivirus. On monitoring it says: "Agentic AI activity should be treated as a form of user activity." It also warns that an agent running directly on a computer, with no isolation around it, may be able to use the credentials of the account it runs under (NCSC). If an agent runs on your laptop under your own account, with no sandbox around it, that's the situation the NCSC describes.

If you run an agent on your own computer, here's what we'd do:

• Keep its permission checks on. The flags the Nx malware reached for exist to switch those checks off. Sophos's telemetry included a Claude Code session started with one of them, and Claude Code's documentation is explicit about that flag's risks.
• Give it one folder, not your whole home directory, and ideally a container that can reach only what it needs, such as the AI service it talks to. Our piece on free AI models shows the idea with Docker.
• Keep passwords, keys and tokens out of its reach. If one slips into an agent's context, change it, because deleting the chat doesn't take it back.
• Treat a new MCP server, skill or plugin as new software from a stranger. Our MCP piece covers what to check.
• Keep approvals on for anything that deletes, pays or sends, and know their limit: people approve nearly everything they're asked to, as our glossary entry on human-in-the-loop explains.
• If your security software has an agent feature, turn it on. Count it as one more check, not the fix.

In a company, we'd add four things:

• Know which agents run on which machines. Microsoft's discovery list gives a sense of how many there are.
• Give each agent its own identity and short-lived credentials, as the NCSC suggests, so its actions show up as the agent's and not a person's.
• Log what agents do, send it to whoever watches your security, and alert on the attempt as well as the result. OpenAI's own experience, where the alarm worked and the stop didn't, is the case for testing your off switch too.
• Test agents before you roll them out, the way you'd test any system that can act on your data. That's part of our AI security work.

Where we'd stop short

We haven't found a published incident that shows a home user's antivirus missing a hijacked agent in a specific case. The evidence here comes from vendor telemetry, lab tests and incidents where nobody said what security software was running. Most of the sources sell security products, and so do we. Microsoft's and Norton's agent features are months old and may get much better. But the evidence we found points one way. The companies that make antivirus are building something new for agents, and OpenAI, which makes agents, says prompt injection is unlikely ever to be fully solved. That's the problem we're working on at Redvault. AgentShield, still in development and not yet launched, is built to show which AI agents are running on a company's Macs: which files they open, which commands they run and where they connect. It's also built to flag it when an agent starts behaving differently. Today it observes and classifies. Controls to block or restrict an agent are in development.