Social engineering that targets an AI agent or uses an AI agent as the delivery path instead of focusing only on the human user. The attacker’s goal is still to manipulate trust into action, but the defender must govern machine-driven decisions, not just user awareness.
What Agent-Directed Social Engineering Means
Agent-directed social engineering exploits the fact that an AI agent can be persuaded, redirected, or overloaded into taking actions that a human user never explicitly intended, turning manipulation of trust into a machine-executed outcome.
How the Attack Works
The attacker is still relying on classic social engineering ideas, such as urgency, authority, or false legitimacy, but the target is the agent’s decision path rather than only the person in front of the screen. That can mean malicious instructions inside content the agent reads, deceptive tool outputs, poisoned context, or prompts that make the agent treat an untrusted request as approved.
Because the agent may hold delegated access, cached context, or tool authority, the damage can scale faster than a human-only scam. A successful trick may not just change what the system says; it may change what it does.
Why It Is Dangerous
The risk is not limited to misinformation. An agent that can browse, call APIs, move data, or trigger workflows may become the execution layer for fraud, exfiltration, unauthorized actions, or policy bypass. That is why the control problem shifts from awareness training alone to governance over what the agent is allowed to trust, decide, and perform.
Human users can often pause, question, or verify. Agents may not, especially when the attack is embedded in content or delivered through a path the defender assumed was safe.
Control Boundaries and Trust Decisions
Defence depends on separating user intent from agent authority. The strongest boundary is to make the agent operate under explicit, narrowly scoped policy, with per-action checks for sensitive requests and clear limits on what it can do on a user’s behalf.
When an agent has access to high-value systems, the trust boundary should include the full chain of inputs, tools, and delegated permissions. AI Agent Authorisation Guide is useful here because it frames least privilege, task-scoped access, and approval gates as the practical answer to agent misuse.
For organizations building or selecting controls, Agentic AI Security Guide helps connect social manipulation to the wider attack surface across inputs, memory, tools, orchestration, and identity.
Detection, Review, and Recovery
Detection works best when teams can reconstruct what the agent saw, what it decided, and what it executed. Audit trails, attribution of agent actions, and signals for unusual tool use or approval bypass are essential because the compromise may look like legitimate automation at first.
After an incident, review the agent’s recent actions, delegated permissions, connected accounts, and any credentials or sessions that could have been used in the abuse path. AI Agent Observability, Audit and Incident Response Guide supports that post-incident reconstruction, including kill-switch thinking and revocation of agent access.
Where agents operate through browsers or desktop sessions, Browser and Computer-Use Agent Security Guide is especially relevant because session abuse and site confusion often become the delivery path for manipulation.
Risk and Threat Considerations
Agent-directed social engineering is dangerous because the attacker can target the machine decision-maker directly, then inherit whatever privileges, sessions, or trust the agent already possesses. The result is often faster than a human-targeted scam and harder to spot, because the malicious action may look like normal automation.
Failure mechanism: A deceptive prompt, page, tool response, or workflow input causes the agent to accept untrusted intent as valid and carry out an action inside its delegated authority.
Impact: The agent may disclose data, trigger unauthorized transactions, approve unsafe requests, or propagate the compromise into connected systems before a human notices.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent-directed social engineering exploits agent authority and delegated privilege. |
| ASI02 — Tool Misuse | The attack turns deceptive input into unsafe tool execution by an agent. | |
| ASI09 — Human-Agent Trust Exploitation | This term describes manipulation of the trust relationship between humans and agents. | |
| Recommendation — Enforce per-action authorization checks for agent requests that could alter access, data, or transactions. Constrain tool invocation to approved intents and block high-risk actions without explicit policy approval. Add confirmation gates for requests that exploit user trust or impersonation of legitimate instructions. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Limits the damage when an agent is manipulated into acting beyond necessity. |
| AU-2 — Event Logging | Audit records are needed to reconstruct agent-driven social engineering incidents. | |
| Recommendation — Restrict each agent to the minimum permissions needed for its task set. Log agent decisions, tool calls, approvals, and delegated actions for later review. | ||
Practitioner Guidance
Why practitioners should care: Treat agent persuasion as an authorization problem, not just a content-safety problem. If an agent can act, then manipulation of the agent can become manipulation of the business process.
Common misunderstanding: Many teams assume the user remains the only meaningful trust anchor. In practice, the agent’s permissions, tool access, and runtime context become part of the attack surface and must be governed explicitly.
Practitioner takeaway: Design for explicit approval, narrow delegation, strong logging, and fast revocation so that a fooled agent cannot silently become a trusted attacker path.