AI Agents Are Now Phishing Each Other — and It Works Better Than on Humans
Attackers no longer need to fool your employees. They fool the assistant your employees trust, and the assistant does the rest.
Phishing worked on humans because humans skim, trust familiar senders and act under time pressure. AI agents skim nothing, trust structured input by default and act instantly. Security teams are now reporting a shift: instead of targeting the employee, attackers target the employee's assistant — and let the assistant convince the human, or act on its own authority.
How the attack chains together
- A malicious calendar invite, email or shared document carries an instruction aimed at the recipient's AI assistant, not the recipient.
- The assistant summarises, schedules or drafts a reply — and in doing so executes the embedded instruction.
- The instruction asks the assistant to do something it is legitimately allowed to do: forward a file, confirm a meeting, share a document link.
- The human sees a plausible action from their own trusted tool and approves it, or never sees it at all.
Why agents are easier targets than people
Humans have imperfect but real scepticism. Agents have none unless it is engineered in. An agent cannot smell urgency, does not find a request 'odd', and treats a well-formatted instruction from a document the same as one from its operator. Worse, agents are consistent: once a phrasing works against one deployment, it works against thousands.
What makes this worse than classic phishing
Classic phishing steals credentials. Agent phishing borrows authority. The compromised agent acts with the user's permissions, inside the user's session, leaving logs that look like normal user activity. There is no suspicious login, no foreign IP, no MFA prompt — just a legitimate tool doing a legitimate-looking thing.
Controls that hold up
1. Treat all ingested content as untrusted input
Emails, invites, web pages and documents the agent reads are attacker-controlled surfaces. Instructions found inside content must never be executed as instructions — only summarised as data.
2. Require human confirmation for consequential actions
Sending data out, changing permissions, moving money or sharing documents should need an explicit human approval that shows exactly what will leave and where it goes.
3. Scope agent permissions per task
An assistant summarising email does not need write access to the file share. Least privilege applies to agents exactly as it applies to service accounts.
4. Monitor agent actions, not just logins
Detection has to move from 'who logged in' to 'what did the agent do'. An agent that suddenly forwards files it never touched before is the new impossible-travel alert.
Your employees got security awareness training. Your agents got none. Close that gap before someone else does it for you.
