IRONSCALES Report Finds AI Agents Are Becoming a New Target for Phishing

A phishing message no longer needs to persuade the employee who owns an inbox. It can target the software reading that inbox on their behalf. That is the central warning of IRONSCALES’ new From Deepfakes to Double Agents: The New Face of AI-Driven Cyber Risk report, which finds that enterprise adoption of tools capable of taking action has moved faster than the security controls surrounding them.

In the company-commissioned Censuswide survey, 77% of respondents said an AI agent or tool at their organization had acted on malicious, misleading, or unauthorized content during the previous year. A smaller but still substantial 57% reported at least one confirmed case. Those figures describe respondents’ reports of incidents, including suspected events in the larger total; they are not an independently verified count of successful breaches.

The findings arrive alongside a more encouraging development: investment in deepfake defenses increased, while reported financial losses became less severe. Together, the results point to a practical challenge for security leaders: extending protection to automated decision-makers without abandoning defenses built for people. Censuswide surveyed 501 U.S. IT and cybersecurity…