When phishing emails target AI Agents, the risk is more than just clicking the wrong link

Phishing emails are no longer just tricking employees; they have now started to deceive AI Agents as well.

What's more troublesome is that once an AI Agent is tricked, it's not as simple as clicking the wrong link.

It might directly search your inbox, cloud drive, or CRM for information, and then send the data out on behalf of the attacker.

Last week, a simulation test targeting the OpenClaw email agent uncovered this issue. When AI Agents are connected to email, browser tools, and business systems, the target of traditional phishing attacks is expanding from "humans" to "systems that execute tasks automatically."

Researchers connected an AI email agent to Gmail, Google Workspace API, and simulated enterprise data, letting it handle daily email requests. The results showed that in some scenarios, the attacker only needed to pose as a colleague and make a seemingly reasonable and urgent business request, and the AI Agent would execute high-risk actions.

The problem is not the link, but identity verification

The truly alarming aspect of this issue is not that the AI failed to identify the phishing link.

On the contrary, it performed quite well in some technical phishing scenarios, such as malicious OAuth authorization, fake login pages, and suspicious redirection addresses. In these scenarios, it was able to make judgments and even refuse to proceed with execution.

The problem lies at another level: identity verification and business context.

In the test, the attacker posed as a team member and requested credentials for a test environment. After searching emails and data, the AI Agent sent AWS IAM keys, database connection information, and SSH access details to an external email address.

In another scenario, the attacker requested a file export under the pretext of "doing a quarterly presentation at home," and the AI Agent similarly completed the outbound transmission. Even under stricter security configurations, the AI Agent still skipped identity confirmation because "the request looked urgent and made business sense."

This illustrates a very realistic problem: an AI Agent is not just a smarter email plugin. It is more like a digital employee with privileges.

It can read internal data, understand external input, and send out results. As long as these three capabilities co-exist, phishing attacks are no longer just about "inducing a click," but could become "inducing execution."

The target of drills can no longer just be humans

In the past, when we carried out phishing defense, the focus was usually on humans: whether employees clicked links, entered account passwords, or opened attachments.

However, once AI Agents enter business workflows, the targets of simulation drills must also change.

You need to verify not just "whether humans will be tricked," but also the following questions:

After receiving an external email, can the AI Agent access sensitive internal data?

Can it send emails, export files, or call business systems on behalf of employees?

When it comes to credentials, customer data, financial information, and privilege changes, is human confirmation strictly enforced?

Do tasks originating from email, IM, web pages, and work orders have different trust levels?

If these boundaries are not defined in advance, relying solely on prompts like "please handle emails with caution" is insufficient. This is because the default inclination of an AI Agent is to complete the task. Attackers exploit exactly this: wrapping malicious requests as normal work, and hiding abnormal actions within the context of "helping a colleague handle something."

This is also where phishing drills must evolve next.

Automated workflows must also have brakes

Having conducted phishing drills for several years, we have found that the focus has never actually been on "testing who will click the link."

It is about recreating attacks within real enterprise business scenarios, using genuine baiting methods to verify whether humans will be tricked and at which step they will let their guard down.

Popular meeting notifications, logistics reminders, office system logins, and document collaboration requests—these scenarios are effective because they inherently look like part of daily work. Through delivery rates, open rates, click-through rates, and submission rates, enterprises can see where risks are truly concentrated.

This same logic applied to humans is a phishing drill; applied to AI Agents, it is equally valid.

In the past, what was verified was "whether humans would be tricked." Next, enterprises need to ask one step further: if the same request is handed to an AI Agent to handle, will it continue to execute it as a normal task?

For example, if an email saying "please help me export the customer list" is sent to an employee, the employee might hesitate and ask, "Why did you change your email address?" But if an AI Agent is connected to the mailbox and business systems, and lacks clear operational boundaries, it might only judge: this is a task that can be completed.

Therefore, the change brought by AI Agents is not that phishing emails have suddenly become more advanced, but that the target being induced has changed.

When enterprises carry out phishing defense in the future, they can no longer just look at whether anyone clicks links or submits accounts. They must also start to focus on: after an external request enters the organization, will it be further amplified by automated workflows; when customer data, credentials, financial information, and privilege changes are involved, is there still a human who can stop to confirm.

At this stage, what enterprises can do lies more in process remedies—which actions must have human confirmation, drawing clear boundaries for the permissions given to AI Agents, rather than waiting to catch up once the tools are mature.

What truly needs to be brought into scope is not only whether employees have security awareness, but also whether there are brakes in the automated processes.

In the future, AI Agents will increasingly enter mailboxes, work orders, knowledge bases, code repositories, and business systems. Their value lies in execution, but the risk also comes from execution.

Therefore, the next step in phishing defense is not to train all employees to be security experts, nor is it to expect AI to naturally judge every disguise.

A more realistic approach is to incorporate humans, system privileges, and business processes together into risk reviews.

Reference Sources

BleepingComputer, OpenClaw AI agent found falling for phishing attacks, spills user data, 2026-06-09. (bleepingcomputer.com)

Global Security Research Team Public Experiment, Phishing for Lobsters: How We Tricked OpenClaw into Spilling Secrets, 2026-06-09. (varonis.com)

CSO Online, Autonomous AI agents duped into leaking sensitive data in phishing test, 2026-06-10. (csoonline.com)