What Happened
Microsoft assesses North Korean threat actors’ AI adoption as high, while describing their operations as human-directed. Reported uses include faster reconnaissance, fraudulent job applications, targeted social engineering and malware development. Microsoft also reports use of an agentic penetration-testing framework by two groups and possible AI-generated voice and video use by another [2].
Microsoft researchers observed more than a 15% increase in enterprise ransomware detonations from 2025 to 2026 [3]. Separately, Unit 42 reported two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 [1]. These are different issues, but together they reinforce the need to secure both AI workflows and the conventional systems those workflows depend on.
Why It Matters to Businesses
AI can reduce the time attackers spend preparing credible lures and adapting tools; it does not require attackers to automate an entire campaign [2]. For defenders, an agent with access to devices, identities or MCP-connected tools creates another path through which a malicious instruction could reach business systems. Microsoft says Defender can discover local agents and configured MCP servers and map their access relationships; its Windows runtime protection for blocking malicious instructions remains in preview [3].
Kimbodo Engineering Perspective
Treat an AI agent as a privileged software integration, not as a trusted employee. Its effective authority comes from the credentials, tools and data it can reach. Restricting that authority is more dependable than relying on an instruction telling the model not to misuse it. Agent discovery is useful, but a discovered MCP connection is not evidence that its permissions are appropriate.
Keep conventional security work in scope. An exposed, vulnerable PHP service can provide an entry point regardless of how well an AI application handles prompts [1]. Likewise, vendor-reported detection speed in one incident—128 seconds from the first high-severity alert to stopping a second-stage payload at QNET—should not be treated as a guaranteed response time [3].
How We Would Implement It
- Inventory agents, MCP servers, service identities, tool permissions and data flows. Assign an owner and business purpose to each connection.
- Give agents scoped, short-lived credentials. Separate read access from actions that change data, send messages, execute code or deploy software; require human approval for high-impact actions.
- Validate tool inputs and outputs, isolate untrusted retrieved content, and test whether malicious instructions in documents, messages or tool responses can trigger unauthorized actions.
- Log prompts, tool calls, approvals and resulting changes with appropriate data minimization. Correlate those events with endpoint, identity and cloud telemetry for investigation.
- Maintain patch and exposure management for the underlying application stack, including affected PHP deployments, alongside phishing defenses, employee screening where relevant, and endpoint response [1][2].
Risks, Costs and Security
Approval gates and narrow permissions can slow legitimate workflows; broad permissions make an agent more useful but increase the consequences of a compromised session or malicious instruction. Logging improves investigation but adds storage, privacy and access-control obligations. Prioritize controls around agents that can execute code, access sensitive records or act across systems, then measure blocked actions, false positives and time to contain incidents before expanding autonomy.
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
