IRONSCALES Report Finds AI Agents Are Becoming a New Target for Phishing

A phishing message no longer needs to persuade the employee who owns an inbox. It can target the software reading that inbox on their behalf. That is the central warning of IRONSCALES’ new From Deepfakes to Double Agents: The New Face of AI-Driven Cyber Risk report, which finds that enterprise adoption of tools capable of taking action has moved faster than the security controls surrounding them.

In the company-commissioned Censuswide survey, 77% of respondents said an AI agent or tool at their organization had acted on malicious, misleading, or unauthorized content during the previous year. A smaller but still substantial 57% reported at least one confirmed case. Those figures describe respondents’ reports of incidents, including suspected events in the larger total; they are not an independently verified count of successful breaches.

The findings arrive alongside a more encouraging development: investment in deepfake defenses increased, while reported financial losses became less severe. Together, the results point to a practical challenge for security leaders: extending protection to automated decision-makers without abandoning defenses built for people.

AI Agents Have Access to Systems That Matter

Censuswide surveyed 501 U.S. IT and cybersecurity professionals at middle-management level or above, working at companies with 1,000 to 10,000 employees. Participants were ages 25 to 55, and fieldwork ran from September 9 to 17, 2026. The results therefore describe this enterprise sample rather than every business using AI.

Within that sample, 96% said their organizations use AI agents or tools that can act on employees’ behalf, and 52% described adoption as widespread. The report uses a broad definition that includes tools reading and responding to messages, accessing files, and triggering workflows.

Among organizations using these tools, 67% allow access to ticketing or helpdesk systems, 56% to cloud storage, and 49% to email or messaging. Another 30% allow access to finance, billing, procurement, or payment systems. Only 19% said their tools were restricted to the public web with no internal access.

The distinction between answering a question and executing an action is consequential. An incorrect summary can mislead a reader; a tool connected to business systems can also move information or initiate a workflow. The permissions surrounding the tool help determine how far a mistake can travel.

The Inbox Is an Entry Point for Agents, Too

Among respondents reporting an AI-agent-related incident, 42% said an AI tool summarized or acted on a malicious email or message. Another 41% reported an attacker using an AI tool in phishing or social engineering. These categories can overlap, and the second includes attacker use of AI rather than necessarily a compromise of the victim’s own agent.

That nuance matters. The survey brings several kinds of AI-related failure into one picture; it does not establish that every incident involved the same attack technique. It nevertheless shows why organizations need to examine the content agents consume as well as the actions their integrations permit.

A useful way to understand the risk is to separate information from authority. A message may contain instructions, but its arrival in an inbox should not make those instructions authorized. When software can act across connected systems, maintaining that boundary becomes part of access control and workflow design.

IRONSCALES’ email security platform reflects its focus on that entry point. The company describes an API-based approach combining AI analysis, automated investigation, and human threat intelligence, alongside phishing simulations and deepfake protection for Microsoft Teams. Those capabilities provide context for the research sponsor’s perspective; this survey does not independently evaluate the effectiveness of its products.

Approval Processes Exist, but Security Rarely Leads Them

Among the 479 respondents whose organizations use action-capable AI tools, 78% named IT as the primary approver of agents, assistants, plugins, and connectors. Just 6% named security, while 14% described approval as shared across groups.

Being the primary approver is different from having any involvement. The figures do not show that security is excluded from every remaining approval process. They do show that decisions about tools with significant access are usually led elsewhere.

Among organizations reporting an incident, 39% said an employee had granted an AI tool access that security would not have approved. That finding makes the governance question concrete: who evaluates permissions before a connector is enabled, and who can revoke them when the tool behaves unexpectedly?

The report also finds a gap between confidence and implementation. While 93% said incident response plans cover AI agents and 84% were confident they could identify an AI-driven incident, only 52% described formal policies, controls, and incident response processes as all being in place. Another 35% reported policies with limited technical controls.

Deepfake Losses Fell, but the Threat Persisted

The deepfake findings offer a more positive comparison with Censuswide’s 2025 survey of 500 respondents with the same profile. Active investment in defenses rose from 37% to 48%. Among organizations reporting financial losses, the share losing at least $100,000 declined from 63% to 49%, and the share losing $1 million or more fell from 6% to 3%.

Estimated average losses among financially affected organizations fell from roughly $280,000 to $225,000. These estimates use the midpoints of reported loss ranges. Because the surveys asked about losses differently, the comparison excludes zero-loss, unsure, and prefer-not-to-say responses.

The report explicitly cautions that higher investment and lower losses moving together does not prove that one caused the other. Nor did incidents disappear: 84% reported at least one deepfake-related incident, compared with 85% in 2025. Its definition is broad, extending from manipulated images and doctored emails to real-time voice and video impersonation.

There is also a competing-priorities problem. The share calling deepfake defense a top priority fell from 71% to 60%, even as action-capable AI introduces another demand on security budgets. Lower losses offer a reason to examine what is working, rather than assume the threat has passed.

Protect the Actions, Not Just the Conversation

IRONSCALES recommends involving security in agent approval, limiting permissions, monitoring actions, and testing incident response with attacks aimed at both employees and agents. These recommendations connect the report’s two themes: deceptive content remains dangerous, but software with permission to act changes how that deception can produce consequences.

For an enterprise team, that means knowing which agents exist, what systems each can reach, and which actions require human review. Logs need to make it possible to reconstruct what the tool read and did. Testing should examine whether an untrusted message can influence an authorized workflow, rather than measuring only whether employees recognize a suspicious email.

The report’s strongest contribution is its account of the distance between adoption, confidence, and implemented controls. Readers can explore the survey questions, methodological qualifications, and recommendations in the full From Deepfakes to Double Agents: The New Face of AI-Driven Cyber Risk report.