AI Agents Are Getting Phished. Security Teams Lead Approval At Just 6% of Firms

Estimated reading time: 7 minutes

IRONSCALES surveyed 501 US IT and security leaders on AI agents and phishing. Of them, 77% said an AI agent acted on malicious, misleading, or unauthorized content last year. Security teams lead approval of those agents at just 6% of companies using them. I asked CEO Eyal Benishti what counts as an incident and what the data leaves out.

AI agents can reach the inbox at about half of the companies that use them. That is one finding of IRONSCALES‘ 2026 Cybersecurity Threat Report. Attackers have started phishing them.

Censuswide survey, from Sept. 9 to 17. All were middle managers or above at companies with 1,000 to 10,000 employees. IRONSCALES commissioned the survey and released the report Oct. 21. IRONSCALES sells AI-powered email security. That is the report’s first recommendation.

Of those surveyed, 96% say their company uses AI agents or tools that can act for employees. More than half say use is widespread. And 77% say an agent acted on malicious, misleading, or unauthorized content in the past 12 months. That includes 57% with a confirmed case.

What Counts As An AI Agent Phishing Incident

The definition is broad. I asked Benishti whether an AI tool that summarized a phishing email counts, even if nobody acted on it.

“The survey frames ‘incidents’ as any situation in which an AI agent or tool takes an action based on instructions, prompts, emails, files, or content that later turned out to be malicious, misleading, or unauthorized,” he said in written answers to my questions. “For that specific example, the answer would be yes.”

That sets a low bar. A summary of a phishing email counts toward the 77%. So does an agent that wrongly triggered a payment.

Summarizing or acting on a malicious email was also the most common incident type. It came up at 42% of the 384 companies reporting an incident. An attacker using an AI tool in a phishing attempt came next, at 41%.

The heavier outcomes ran close behind. About a third of those companies said an AI tool shared, sent, or exposed sensitive information. A similar share said one triggered a workflow, ticket, payment or system change incorrectly. Across all 501 respondents, each comes to about one in four. That is a Cyber Insurance News calculation from the report’s figures. Both counts include suspected cases.

Gartner’s survey of CISOs on deepfake calls had a similar limit. A detected attempt counted alongside a successful one.

AI Agent Incidents Without Loss Data

I asked how many confirmed cases led to a financial loss, data exposure, or account takeover. “We do not have data regarding financial losses or account takeovers,” Benishti said. He pointed to the share reporting exposed sensitive information.

The survey also skipped cyber insurance. “The survey did not include any questions regarding insurance,” he said.

That leaves underwriters without a link between these incidents and claims. Phishing already drives losses at some insurers. At Resilience, phishing, social engineering and transfer fraud made up 85% of incurred losses in the first half of 2026.

The survey hints at a coverage question. Social engineering endorsements commonly cover “an employee’s good-faith reliance on fraudulent communications,” lawyers at Ward and Smith wrote in July. In the survey, 56% rate a deceived AI agent as at least as risky as a deceived employee. The survey cannot show how insurers would treat a loss when the deceived party was an AI agent.

Where AI Agents Have Access

Access is what makes AI agent phishing costly. Among companies using agents, the most common access is to ticketing and helpdesk systems, at 67%. Cloud storage follows at 56%. Email and messaging platforms tie with internal file stores at 49%.

Agents can reach finance, billing, procurement, or payment systems at 30% of those companies. Only 19% limit agents to the public web.

“Phishing has always targeted the people who read email,” the report says. “Now it can target the software that reads email for them.”

Prompt Injection Arrives By Email

MITRE added indirect prompt injection to its ATT&CK framework this month. The technique hides instructions in content an AI system reads. I asked Benishti whether that is what IRONSCALES sees in email.

“Prompt injection is absolutely one of the primary methods being used to exploit AI agents via email today,” he said.

Older tricks work too. “Traditional phishing and business email compromise can sometimes be even more effective against agents than they are against humans,” Benishti said. Attackers point spoofed or compromised addresses, malicious attachments and links at agents, he said.

Who Approves AI Agents

IT approves AI agents, plugins and connectors at 78% of the companies using them. Approval is shared at 14%. Security leads at 6%.

Among companies reporting an incident, 39% say an employee gave an AI tool access that security would not have approved. Graylog CMO Kimber Spradlin described the same pattern in marketing on a recent Cyber Insurance News podcast. Cheap tools bought on expenses can skip full procurement.

“It certainly makes sense to have IT involved in vetting AI agents and tools, but doing so without primary involvement of security teams is not advisable,” Benishti said.

I asked whether approval includes checking which inboxes and systems an agent can reach. “Yes, approval would include more than just whether or not an agent or tool is adopted, but also how it is implemented and what kinds of guardrails are put around it,” he said.

Confidence runs ahead of controls. Of those surveyed, 93% say their incident response plan covers AI agents. Only 52% describe formal policies, controls, and response processes all in place. IRONSCALES calls this the “preparedness paradox.”

Deepfake Losses: Smaller On Average, Reported By More Firms

The report’s second story is deepfakes. Companies investing in deepfake defense rose from 37% to 48% in a year.

Among companies that lost money, the estimated average loss fell from roughly $280,000 to roughly $225,000. Losses of $1 million or more fell from 6% to 3% of those companies. IRONSCALES estimates the averages from range midpoints.

More companies reported losing money, though. Benishti said 276 respondents reported deepfake financial losses in 2025. This year, 383 did.

Those counts may not compare cleanly. In 2025, only respondents who reported a loss were asked the amount. In 2026, everyone was asked, with a “$0 / no known losses” option. The report says so in a footnote.

On those figures, the average deepfake loss got smaller while more companies reported one. The report itself urges caution on cause and effect. Survey data alone “can’t prove that one caused the other,” it says.

Deepfake incidents held steady. Of those surveyed, 84% reported at least one in the past 12 months, against 85% a year earlier. Shufti projects document deepfakes will rise about 40-fold this year.

FAQ – AI Agent Phishing

What is AI agent phishing?

An attack aimed at the AI tools that read and act on email for employees. A malicious message can steer the agent instead of fooling a person.

How common are AI agent incidents?

In IRONSCALES’ survey of 501 US IT and security leaders, 77% said an AI agent acted on malicious, misleading or unauthorized content in the past year. 57% had a confirmed case.

What counts as an incident in the survey?

Any case where an AI tool acted on content later found to be malicious, misleading or unauthorized. CEO Eyal Benishti says that includes summarizing a phishing email nobody acted on.

Did the survey measure losses from AI agent incidents?

No. IRONSCALES has no data on financial losses or account takeovers from these incidents. The survey asked no insurance questions.

Who approves AI agents at most companies?

IT, at 78% of companies using agents. Security is the primary approver at 6%. Benishti says security teams should be primarily involved.

What is indirect prompt injection?

Instructions hidden in content an AI system reads, such as an email. MITRE added it to its ATT&CK framework in October 2026.

Related Cyber Insurance Posts

• A Two-Person Vendor’s Login Reached 8.8 Million Danish Records. A Bill Caught It.
• Cyber Insurance “Policy Buyback” Approved for Victims of 23andMe Hack(Opens in a new browser tab)
• Half Of This Year’s Manufacturing Ransomware Came From Groups That Did Not Exist Two Years Ago(Opens in a new browser tab)
• AI Risk Rises As Netskope Flags Data Leaks, Shadow Tools, And Agentic Exposure For 2026(Opens in a new browser tab)
• Agentic AI: 98% Have Already Had An Incident. Few Can Prove What Happened(Opens in a new browser tab)