AI Security, Fake AI Apps, and the EU AI Act: What Firms Should Review

Microsoft's warning about agentic insiders

Hayete Gallot, writing on the Microsoft Blog on October 19, 2026, described AI agents as a new kind of insider risk. An agent can take action across systems with the access it has been given. If those permissions are broader than the job requires, or if the model is treated as implicitly trustworthy, the agent can cause damage without a human attacker sitting at the keyboard.

Gallot wrote that frontier models should not be implicitly trusted, and that agents are often overprivileged. Microsoft's proposed direction includes "Guardian Agents" that watch other agents, plus Project Perception, which Microsoft said it announced in July, as part of a broader effort to observe and contain agent behavior. The practical takeaway for a small or mid-size firm is simpler than Microsoft's product names: inventory the AI tools staff already use, list what each tool can reach (email, files, customer systems, payment tools), and do not grant an agent production access until someone has written down what "done" looks like and who reviews the output.

That inventory is also where earlier supply-chain incidents belong. In late October, Microsoft and Cursor documented a tampered Claude Code extension that tried to plant a persistent SSH backdoor on developer workstations. Details and remediation pointers are in our article on the malicious Claude Code extension.

Fake ChatGPT and Claude apps: the Yoba campaign

On October 27, 2026, Eli Smadja of Check Point Research described a campaign Check Point calls Yoba. According to that report, attackers published fake GitHub projects and GitHub Pages that used well-known model names, including GPT-5.6 Sol, GPT-6 Astra, and Claude Opus, to impersonate desktop apps. People searching for those new names were steered toward a download that looked official.

Check Point says the packages included a legitimate, digitally signed OpenAI or Anthropic Setup.exe paired with a malicious winmm.dll. Windows then loaded the extra DLL alongside the signed installer, a technique known as DLL sideloading. Check Point is explicit that OpenAI and Anthropic themselves were not compromised. The signed files were abused, not stolen from a broken vendor build system in the way the report describes.

Check Point observed XMRig 6.26.0, a cryptominer, in the activity it analyzed, and said the Yoba loader can also deliver other executable or PowerShell payloads. The report described search-engine optimization techniques used to make the fake project pages appear in results for people hunting new AI apps.

The standing advice is ordinary and easy to skip when a new model name is trending: download ChatGPT, Claude, or any other official desktop app only from the vendor's own site or an official store listing. A signed file inside a ZIP from GitHub is not the same thing as an official download page. If someone on your team already installed a third-party "GPT-6" or "Claude Opus" desktop wrapper, treat that workstation as a security incident, not a software update.

EU AI Act dates firms should actually look up

The EU AI Act is Regulation (EU) 2024/1689. The European Commission's "Shaping Europe's digital future" page and the AI Act Service Desk timeline describe a staged rollout, later adjusted by the Digital Omnibus on AI (also called the AI Omnibus). The Commission says a political agreement on that simplification package was reached on May 7, 2026, and that it entered into force on July 27, 2026.

The official timeline, after those amendments, includes these dates:

• August 1, 2024: the regulation entered into force.
• February 2, 2025: general provisions, including definitions and AI literacy obligations, and the first set of prohibited practices began to apply.
• August 2, 2025: rules for general-purpose AI models, and the requirement that governance structures be in place.
• August 2, 2026: the majority of remaining rules come into force and enforcement starts for the applicable rules, including Article 50 transparency obligations.
• December 2, 2026: additional prohibitions apply for AI systems that generate non-consensual sexual deepfakes or child sexual abuse material. The timeline also lists a transitional deadline under Article 50(2) for certain providers of systems that generate synthetic content and were already on the market before August 2, 2026.
• December 2, 2027: rules for high-risk AI systems listed in Annex III apply. The Commission's policy page gives examples of high-risk uses that include employment tools such as CV-sorting software for recruitment, once those rules apply.
• August 2, 2028: rules for high-risk AI embedded in regulated products covered by Annex I apply. The Service Desk describes this as the date by which the main application milestones are foreseen to have rolled out.

On transparency, the Commission explains that people should be told when they are interacting with a chatbot or similar machine; that providers of generative AI must ensure AI-generated content is identifiable; and that certain content, including deepfakes and text published to inform the public on matters of public interest, should be clearly labelled. The Commission says those transparency rules come into effect in August 2026, matching the Service Desk note that Article 50 starts to apply on August 2, 2026.

We are not a law firm, and we are not telling a U.S. business whether it is or is not in scope. Offering an AI tool, chatbot, or AI-generated marketing content to people or customers in the EU can raise questions that belong with qualified counsel. The dates above are from official Commission pages so you can take them into that conversation rather than relying on a recap.

What to do

1. Inventory the AI tools people already use. Include chatbots, coding assistants, browser extensions, and any "agent" that can send email, edit files, or reach a customer system. Write down what each tool can access.
2. Download only from official vendor channels. Do not install desktop apps named after a new model from GitHub, a boosted search result, or a ZIP a colleague forwarded. If a machine already did, isolate it and investigate.
3. Treat marketplace extensions as trusted software. The Claude Code incident showed that a familiar name in an extension marketplace is not the same as a vendor-built package. Restrict who can install extensions on machines that hold client data.
4. Give agents the least access the job requires. Microsoft's point about overprivileged agents applies even if you never buy a Microsoft security product. An agent with production credentials is an insider with a script.
5. If you serve EU users or customers, calendar the official dates and call counsel. Transparency labelling, prohibited practices, and later high-risk rules are not something a blog post can settle for your firm. Read the Commission's pages and get advice that fits what you actually offer.

Why this matters for NTx clients

Most owner-led firms we work with are not training frontier models. They are letting staff try ChatGPT or Claude, wiring a helper into an existing process, or publishing AI-assisted copy on a website. The failures that actually show up are ordinary: a download that was not official, an extension that looked legitimate, an agent that was given too much access, or a customer-facing chatbot that never disclosed it was a machine.

Reviewing those points is part of an AI Readiness Consultation. When the exposed system is a WordPress site or a plugin-installed helper, the same conversation belongs with WordPress Security.

FAQ

What is an agentic insider?

Microsoft used the phrase in an October 19, 2026 blog post by Hayete Gallot to describe AI agents that can act inside a company with the access they have been given. If those permissions are too broad, or if the model is trusted without review, the agent can cause harm without a human attacker at the keyboard.

Were OpenAI or Anthropic hacked in the Yoba campaign?

Check Point Research says no. The October 27, 2026 report describes attackers pairing a legitimate, signed OpenAI or Anthropic Setup.exe with a malicious winmm.dll so Windows would load the extra file. Check Point states that OpenAI and Anthropic themselves were not compromised.

Which fake app names should we watch for?

Check Point reported fake GitHub projects and pages using names such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus to impersonate desktop apps. New model names will keep appearing. The safer habit is to download only from the vendor's official site, not from a search result or GitHub ZIP that happens to use a trending name.

When do EU AI Act transparency rules apply?

The AI Act Service Desk says Article 50 transparency rules start to apply on August 2, 2026, when the majority of remaining rules come into force and enforcement starts for applicable rules. The Commission's policy page says people should know when they are talking to a chatbot, that generative content should be identifiable, and that certain deepfakes and public-interest text should be labelled. This is not a determination of whether any specific firm must comply.

Does the EU AI Act already ban every high-risk hiring tool?

Not on the timeline published after the Digital Omnibus on AI. The Service Desk and the Commission policy page say rules for high-risk AI systems in Annex III apply from December 2, 2027, and rules for high-risk AI embedded in Annex I products apply from August 2, 2028. Employment tools such as CV-sorting software are listed by the Commission as an example of a high-risk use case when those rules apply. Ask counsel how that maps to what you use or sell.

Sources

1. Hayete Gallot, "Securing the agentic insider," Microsoft Blog, October 19, 2026. https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/
2. Eli Smadja, "Yoba Malware Abuses Signed ChatGPT and Claude Binaries to Target AI Users," Check Point, October 27, 2026. https://blog.checkpoint.com/research/yoba-malware-abuses-signed-chatgpt-and-claude-binaries-to-target-ai-users/
3. European Commission, "Timeline for the Implementation of the EU AI Act," AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
4. European Commission, "AI Act," Shaping Europe's digital future (Regulation (EU) 2024/1689, risk categories, and Digital Omnibus dates). https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
5. Microsoft Security Research, "Inside a malicious Claude Code-branded extension and its persistent SSH backdoor," Microsoft Security Blog, October 30, 2026. https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/