How attackers use agentic AI for phishing

WitnessAI | August 29, 2026

Agentic AI can run phishing campaigns without a human attacker at the keyboard. An agent researches the target, writes the lure, sends it, reads the reply, and escalates across email, voice, and collaboration tools.

Because the agent handles each step, campaigns can move at a pace and volume that many controls weren’t calibrated for. Managing that activity requires one policy framework for employees and agents.

Below, you’ll see how these campaigns run today and where AI risk management can restore the defenses that have fallen out of calibration across your human and digital workforce.

Key takeaways

• AI agents can automate the full phishing lifecycle, from target research and lure creation to delivery, reply handling, and escalation across multiple channels.
• Established defenses lose effectiveness when automated campaigns remove familiar message fingerprints and use deepfake voice or video to imitate trusted colleagues.
• Internal copilots and agents are phishing targets because indirect prompt injection can exploit their authorized access to sensitive tools and data without user interaction.
• Layered protection must combine phishing-resistant authentication with AI discovery, intent-based policies, runtime guardrails, least privilege, and continuous monitoring.

What is agentic AI for phishing?

Agentic AI for phishing uses autonomous AI systems to plan and execute social engineering campaigns end to end. Generative AI drafts a convincing email; an agent decides who receives it and what comes next.

Agents collect open-source intelligence on their own. From only a name and affiliation, GPT-4 retrieved personal information about targets with precision up to 0.95. They sustain multi-turn conversations. They adapt tone and pressure across sessions.

Agentic systems can also orchestrate reconnaissance and email delivery on their own, then conduct follow-up social engineering that includes deepfake voice calls. Fully AI-automated spear phishing matched human expert-crafted lures at a 54% click-through rate, against 12% for generic control emails. Human and systemic failures remain the root cause of most successful intrusions. Agentic phishing changes campaign operations, so focus controls there.

How attackers run agentic phishing campaigns today

Attackers can configure the agent once, then let it run the campaign while they step in only at decision points. That shift matters because campaign throughput no longer depends on how many operators are on the keyboard. A single handler can supervise dozens of parallel conversations, each with its own target, tone, and pretext, while the agent handles the routine work of drafting, sending, and reading replies.

Anthropic’s disclosure of GTG-1002, an espionage campaign it assessed as Chinese state-sponsored, offers a published example of that autonomy. Ars Technica reported questions about Anthropic’s assessment, and the debate over exactly how autonomous the campaign was is worth watching.

The underlying architecture is what security teams should focus on, because the same pattern is available to any attacker with access to a capable model and a few open-source tools.

The attackers exposed offensive security tools as MCP servers while running Claude Code on Kali Linux. They also broke the work into discrete tasks for sub-agents. That setup lets sub-agents handle reconnaissance and email delivery, then manage follow-up. It scales campaign activity beyond attacker headcount, and it lets each sub-agent specialize: one drafts pretexts against a specific department, another manages reply threads, another pivots to voice or chat when email stalls.

The operational tempo changes too. Campaigns can run around the clock, adapt to responses within seconds, and pause or accelerate based on target behavior. Controls calibrated to human-paced campaigns, where analysts had hours or days to spot patterns across a wave of similar emails, don’t hold up against activity that fingerprints differently on every send.

Why current defenses lose calibration, including your own AI agents

Three gaps explain why these defenses lose calibration:

• Message-signature calibration: Email gateways and awareness programs were tuned against a threat with observable fingerprints, and agentic AI phishing can remove many of those fingerprints. Signature-based filtering assumes shared artifacts across a campaign. Training built on spotting typos and awkward phrasing is calibrated to a lure quality that automated campaigns have already matched.
• Multimodal identity verification: Deepfake voice and video can make recognized colleagues appear to confirm a request. The Arup example below shows how that can undermine an out-of-band check.
• Indirect prompt injection against copilots and agents: The copilots and agents your teams deployed are targets too. A phishing payload may instead target the agent reading an employee’s inbox.

Together, these gaps require coordinated controls for identity and AI activity.

At Arup’s Hong Kong office, a finance employee joined a video conference where every other participant was AI-generated, including the CFO. The employee executed 15 wire transfers totaling HK$200 million, about US$25.6 million. The attack defeated the control of confirming a request with a recognized colleague. Those failures can lead to wire transfers sent against fraudulent requests. They may also require you to report an incident when an agent leaks regulated data.

EchoLeak research documented CVE-2025-32711, rated CVSS 9.3. A single crafted email caused Microsoft 365 Copilot to access internal files and transmit their contents to an attacker-controlled server with zero user interaction. For a regulated organization, an incident like that would likely need to be assessed against SEC materiality criteria, triggered without a user opening the email.

Prompt injection is a top LLM application risk for this reason. Indirect prompt injection can exploit an agent’s authorized access to tools and data, which is why OWASP recommends agent least privilege.

Use detection to reduce prompt-injection success while accounting for the remaining risk. As agent deployments grow, OWASP recommends layered controls, tool restrictions, and continuous monitoring because residual rates compound quickly.

Building AI risk management that covers both workforces

Apply the same AI governance policies to employees and agents, and enforce them while each interaction is happening. This can also help move an AI project beyond the pilot stage because risk committees rarely sign off on activity they can’t see.

1. Start with discovery, including agents nobody registered

Discovery increasingly needs to reach unregistered agents, along with the unsanctioned chat tools that come to mind first. The NCSC puts the threshold bluntly in its agent deployment guidance: "If you cannot understand, monitor or contain an agent’s actions, it is not ready for deployment." Shadow AI now includes unsanctioned tools, AI features switched on inside approved SaaS, and locally built agents.

Effective discovery reaches beyond the sanctioned model catalog. It should surface AI applications and agentic activity in developer tools and IDEs, along with local custom agents and the public and private MCP servers they access. Network-level observability can help close visibility gaps across activity that browser- or application-specific controls may not capture.

2. Classify by intent

Intent-based classification uses ML models that read conversational context and purpose. That can help surface an exfiltration attempt phrased as an ordinary request, or distinguish a research question from a code-generation task that touches sensitive systems.

Policy actions should go beyond binary allow or block. Warn and route options give employees a sanctioned path when the intent is legitimate but the destination isn’t, which keeps AI use inside the approved stack rather than pushing it further into shadow use.

3. Put runtime guardrails on AI interactions

Gartner’s AI TRiSM framing describes AI runtime enforcement that detects anomalous activity and blocks risks automatically. Bidirectional runtime defense should cover both prompts and responses. Pre-execution scanning can help detect and block prompt injection and jailbreak attempts before they reach the model or agent, and response inspection filters harmful outputs before they reach users or trigger unintended actions.

Before an agent goes live, assign owners for access approval and ongoing behavior monitoring. Document who can stop the agent as well. Assign owners in Security, Compliance, Legal, HR and Marketing because each team carries a different part of the exposure.

Data tokenization identifies and tokenizes PII, credentials, and IP before they reach an AI model or agent. Look for guardrails with efficacy validated in production against a range of LLM types, since residual false-negative rates compound quickly as agent deployments grow.

4. Close the phishing-resistant authentication gap in parallel

The only widely available phishing-resistant authentication today is FIDO/WebAuthn, with number-matching MFA as a reasonable interim step for organizations not yet able to deploy it.

Runtime guardrails complement existing network security controls by inspecting conversational context. They don’t replace identity controls or your secure email gateway.

5. Make agent actions provable to the board and regulators

Agent actions should connect back to the human identity that triggered them, captured in immutable audit trails. That record gives a board and its auditors evidence they can use, including for EU AI Act requirements. Agent-specific regulatory requirements continue to evolve, so you should have evidence ready as obligations develop.

Practically, that means capturing which agent took an action, which human identity authorized it, which tools and data it touched, and what policy applied at the time.

When a board asks whether an agent acted on a poisoned instruction, or an auditor asks how a data-handling exception was resolved, the answer should come from a single record rather than a reconstruction across multiple systems. Building that evidence layer now is easier than retrofitting it after an incident or a regulatory request forces the question.

Establishing governance for the agent workforce

Attackers are increasingly incorporating AI into offensive workflows, while many enterprises are still adapting their defenses to AI-native and agentic threats. That creates the potential for an asymmetry as offensive workflows become more automated and scalable. Closing it depends on AI risk management that sees and governs AI behavior across employees and agents from one policy framework.

WitnessAI combines intent-based policies with network-level visibility to govern human employees and AI agents. For supported agentic traffic and applications integrated with WitnessAI, runtime controls can enforce policy and protection as interactions and actions occur.

FAQs about agentic AI for phishing

Can our secure email gateway detect agentic AI phishing?

Keep the gateway in place, but don’t rely on it as the only control. Agent-generated lures can be linguistically distinct, so a campaign may not present a consistent shared signature. Payload-less business email compromise gives gateways little to inspect, and voice and video channels sit outside the mail flow. Pair gateway filtering with phishing-resistant authentication and runtime controls on AI interactions.

Are our internal copilots and AI agents a phishing target too?

Yes. EchoLeak research showed that a single crafted email can be enough to make an enterprise copilot read internal files and send their contents out, with no user interaction. Indirect prompt injection can exploit the agent’s authorized access. Start by inventorying which agents hold privileged access to email, file stores, and internal APIs.

What should we tell the board about agentic AI phishing risk?

Lead with control evidence when briefing the board. Show which AI applications and agents are discovered and what policy applies to each. Then show whether agent actions trace to the humans who initiated them. That attribution chain is what disclosure and operational-resilience questions ultimately come back to.

Does security awareness training still help against AI-generated lures?

Less than many programs assume. Recent academic research has found little evidence that annual training correlates with reduced phishing failure rates, and programs calibrated to typo-spotting now test against expert-quality writing. Shift training toward out-of-band verification for payment and credential requests, and put technical controls where judgment alone is unreliable.