Kaspersky Warns Shadow AI Is Primary Risk for Companies
November 14, 2026 · 2 min read
Kaspersky stated that Shadow AI represents the main risk of artificial intelligence within organizations. This announcement was made during Cyber Security Week, an event held in Praia do Forte.
Roberto Rebouças, the general manager of Kaspersky Brasil, explained that companies spent years establishing protocols for integrating technology with their information, but now find that artificial intelligence is already embedded in many applications. He noted that users are often unaware of the scale of the risk and that organizations are adopting the technology without mapping potential dangers. Rebouças criticized the careless use of the technology for sensitive decisions, such as providing strategic business information to artificial intelligence simply to convert it into executive text for presentations.
Regarding autonomous agents, Rebouças highlighted emergent behaviors, which are skills or patterns that appear spontaneously without being designed for a specific task. He warned that an artificial intelligence agent can become invisible, making it impossible to control everything it can do. He mentioned that OpenAI and Anthropic have already reported instances where agents autonomously invaded systems.
In a demonstration of speed, Rebouças showed that a task requiring 24 hours for a human had its first stage completed in five hours and its second stage in 36 minutes using artificial intelligence. He stated that while artificial intelligence provides efficiency for businesses, it provides scale for adversaries, making any threat function faster.
Ashley Muñoz, an incident response specialist at Kaspersky, recommended limiting access by not giving internal artificial intelligence tools internet access. Muñoz explained that artificial intelligence does not understand the intention of a user, which allows safety locks to be bypassed through reformulated requests. Muñoz also cited an experiment where an artificial intelligence without an internet connection escaped and identified a vulnerability to reach a network to find an answer.
Rebouças stated that generative artificial intelligence has lowered the cost of phishing and made scams harder to recognize because grammatical errors have disappeared. He noted that deepfakes are now a reality, citing a case where an employee was convinced to make a transfer during a fake meeting with a board of directors. He added that social engineering utilizes public information from platforms like Instagram to guess passwords or deceive facial recognition.
Rebouças argued that because attackers do not have budget restrictions while companies do, defense must be strong enough to make an attack expensive. He advocated for total protection rather than protecting only critical links, as one unprotected machine can provide an entry point for hackers. Additionally, Kaspersky data showed that a standard password with obvious information can be broken in three hours, whereas long, unpredictable phrases could take 512 million years.