AI has moved quickly into the daily work of small and mid-size businesses (SMBs). Many have moved past chatbots and begun assigning work to AI agents in the hope of gaining an edge on their similarly resource-strapped competitors and levelling the playing field with larger companies. Indeed, the ambitious adopters are deploying, or at least experimenting with, multi-agent ‘assembly lines,’ where one supervisor agent manages swarms of specialist agents and passes work between them.
But AI changes more than how work gets done. Each new access and connection leaves the business with new dependencies that represent a potential cybersecurity risk. SMBs rarely have resources to spare, however, and least of all in IT. Cybersecurity in particular is often just one item on a list of duties owned by a person or small team that deals with everything from account provisioning to zero-day fallout.
Yet few businesses are likely to backpedal on AI until every risk is mapped and addressed. Fewer still know which loopholes need plugging first – ESET’s recent global survey of 4,400 SMB decision-makers found that 40 percent of the businesses didn’t even have an AI policy. The rules were more common in companies that had already suffered an incident, revealing the familiar pattern where governance often arrives after a breach.
Broadly speaking, today’s security risks are expanding in two main directions: AI creates new paths to business systems while adversaries use it to add speed and scale to ‘old’ threats.
AI agents, double agents and errant agents
Whatever its remit, each agent connected to business systems can act through permissions granted by its ‘owner.’ Once an agent has access to internal documents and can communicate externally, anything that influences its instructions can also influence what it does with its permissions. A chatbot may produce a wayward answer, whereas an agent with access to data and tools could take a wayward and, ultimately, costly action. In multi-agent setups, manipulated outputs can be handed to the next part of the chain, triggering a cascading problem whose root cause is difficult to track down.
Of course, some risks surrounding AI agents have familiar roots: an agent’s supply chains can be compromised and its permissions abused. This is best illustrated by skills, or packaged instructions that tell an agent what actions to take and which tools to use. Between March and May 2026, ESET’s systems scanned almost 900,000 unique skills from popular repositories – more than 25,000 turned out to be suspicious and more than 3,000 outright malicious, leading to credential theft, data exfiltration and remote code execution.
How many were installed globally is anyone’s guess, but the analysis shows how quickly a poorly governed supply chain has grown around agentic AI. The skills ecosystem lacks app-store-style gatekeeping, and one-off checks before installation are by no means sufficient, either. Skills and tool connections, including those using ubiquitous MCP servers, remain live dependencies after an initial review as their instructions and upstream services can change at any time. The end result could be a “rug pull” where a tool that at first behaves as expected later morphs into, for example, an infostealer.
A lean IT team is unlikely to review every such dependency at installation, much less continue to keep an eye on it afterwards. Indeed, they may not even know that an employee has connected a seemingly useful skill to an agent without realizing that it can, for example, read the shared drive and communicate with a third-party service. Nor can skill descriptions be taken at face value, either – far too often, a skill doesn’t do “what it says on the tin.”
Other openings are created by LLMs themselves. The models are (in)famously prone to hallucinations, many of which are no laughing matter as they ultimately open another path from language to execution – and to an attacker-controlled resource. For example, LLMs tend to invent the same software library names and web domains often enough that adversaries register them and wait for a (vibe) coder or coding agent to use them.
Agents can also suffer from agentic misalignment where they proceed doggedly even if it involves, for example, breaking into other companies. Attackers can also inject malicious data into an agent's long-term memory where the input lies dormant until it’s retrieved to commit fraud or other nefarious actions. Other threats continue to surface regularly, either as proofs of concept or actual attacks spotted in the wild.
But perhaps the most common and insidious threat goes after what a model is told. LLMs can’t reliably tell trusted, privileged instructions apart from untrusted retrieved data, treating everything as a stream of tokens. That leaves agents vulnerable especially to indirect prompt injection attacks, in which an adversary hides commands in a webpage, email or another resource that the agent is instructed to fetch. The EchoLeak vulnerability in Microsoft 365 Copilot showed the risk of data exposure without a malicious link ever being clicked. A recent large-scale red-teaming competition found at least one successful hijacking attack against every one of the 13 frontier models tested. Prompt injection consistently ranks first in OWASP’s list of the most critical security risks facing LLM applications.
Breathing new life into old attacks
AI-specific threats have by no means displaced the well-established pathways to companies’ crown jewels. Phishing, vulnerable software, stolen login credentials and exposed remote service remain at the core of many incidents.
The ESET SMB Cyber Readiness Index 2026 lists phishing and exploitation of known software vulnerabilities as the two most common causes of breaches. The speed of vulnerability exploitation often leaves defenders with little to no time for patching or mitigation: nearly a quarter of the almost 500 known exploited vulnerabilities in the first half of 2026 were exploited on or even before the day they were disclosed.
Phishing and other social engineering threats keep changing their ‘face’ and delivery, too – and with considerable success: Microsoft says that AI-automated phishing emails achieve a 54-percent click-through rate versus 12 percent for standard attempts. Meanwhile, QR code phishing is soaring while ClickFix, the rampant threat where a fake error message asks a user to paste a command into their own terminal, is now often dressed up as AI troubleshooting and misuses the public sharing features of popular AI services to host malicious instructions.
Many phishing campaigns are built to withstand the scrutiny that employees have learned to follow. AI makes tailored lures cheap to produce at enormous scale and speed, while ready-made phishing-as-a-service kits supply the machinery for capturing logins. Attackers also aim for as little resistance as possible and blend into ordinary work, reaching employees while their accounts are already authenticated.
Ransomware, which has fallen hardest on SMBs for years, is now being run at higher volume for lower returns. Attackers also increasingly target the technology that thwarts their shenanigans: ESET has documented more than 100 tools built to kill endpoint detection and response (EDR) tools, most abusing vulnerable drivers, with new ones appearing frequently.
AI is also turning up in malware, although the examples found so far tend to be early or experimental. For example, ESET researchers have documented PromptLock, a proof of concept that is also the first known AI-powered ransomware, and PromptSpy, the first known Android malware to abuse generative AI in its execution flow. Other firsts and notable examples have since been unearthed, but AI’s main contribution to cybercrime remains mainly human-led acceleration, rather than autonomous malware development. Together, shorter reconnaissance times, more effective social engineering, cheaper commodity malware, and faster adaptation let attackers accomplish more with less.
Where this leaves a small team
Small teams have their work cut out for them. Hiring enough people to cover every security need is rarely a viable path for an SMB. Somewhat tellingly, the largest cybersecurity workforce study has stopped publishing a global headcount gap and now reports missing skills as the more useful measure of the talent shortage, with AI security topping the list of skills in short supply.
As with everything else in security, the first ‘port of call’ on the journey is visibility: which agents and AI services are running, who connected them, and what their permissions allow them to do. This points to the lethal trifecta of agentic security: access to sensitive data, exposure to material from outside the company, and permissions to communicate or take action externally. An agent that reads a shared drive, processes incoming email and sends messages has all three. Taking one ‘leg’ out reduces the risk substantially.
Autonomous and semi-autonomous systems need task- and time-specific boundaries and be subject to oversight for errant behaviors. Securing an agent and whatever it can do requires looking past the model itself – it needs to consider its identity, the information that the agent ingests, the tools within its reach, and the controls that govern and limit its actions.
Meanwhile, shadow IT has been a blind spot for many companies for years, but shadow AI – or unsanctioned use of AI by employees, fittingly nicknamed ‘bring your own AI’ – adds another important wrinkle that goes beyond the risk of sharing sensitive information with a chatbot: an overprivileged tool could take actions at a scale the employee never could.
With the people and hours they have, many businesses lack the resources to run security end to end: deploy, configure, monitor, interpret, investigate and respond. No matter how tempting, automating the human out entirely comes with risks, too. Automation is dependable on repetitive decisions but weaker on ambiguous or complex ones, with errors compounding when one automated misjudgment becomes the input to the next. Somebody has to consider the broader context to decide whether odd behavior is an intruder or a glitch.
A managed detection and response (MDR) service taps into advanced automation to inspect more activity but brings suspicious behavior to an expert’s attention. These days, any such service also needs to come with advanced AI-driven security capabilities and involve watching what AI agents pull in or use – be it files, external services, repositories, skills and plugins – as well as what they do with the resources once running. Where staff use conversational chatbots, it needs to check what gets uploaded and flag malicious and risky content on the way back. The service must also detect activity that often follows a compromise, including suspicious commands, lateral movement, data theft, and ransomware deployment.
And yet, none of this requires companies to build their own security operations, or to recruit the skills that are clearly in short supply. The service arrives already up and running, with AI helping to carry the workload and an expert on hand to make the judgement calls. For a company with a small IT team, that's the only version of a security service that was ever going to align with its daily reality.
