Social engineering defense must now cover humans and agents

At a glance

What this is: This is an analysis of how social engineering is shifting from a human-only problem to a threat model that also targets AI agents and agent-driven workflows.

Why it matters: It matters because identity teams now have to govern trust, interaction, and response paths across humans, AI agents, and the systems they operate through.

Context

Social engineering is no longer confined to human judgment errors. As AI agents begin handling support calls, email, and content consumption, the attack surface expands to include machine-driven trust decisions as well as human ones.

For identity and access teams, that changes the question from how users resist phishing to how both humans and agents can be manipulated into authorising actions, revealing information, or exposing credentials. The governance gap is that most awareness and response models were built for people alone.

Key questions

Q: How should security teams stop AI-powered social engineering from leading to privileged access?

A: Security teams should harden the approval path, not just the inbox. Use dual approval, context-based justification, MFA for sensitive transactions, and secondary-channel verification before any privileged change. If the request involves secrets, elevation, or vendor access, the process should require a separate identity check before action is taken.

Q: Why do AI copilots and agents increase social engineering risk in enterprise workflows?

A: They compress trust into a faster decision path. Users are more likely to accept a machine-generated answer, follow an AI-produced instruction or approve an action that appears internally sourced. That makes provenance, user verification and approval design critical, because the attacker is exploiting trust in the workflow, not only the login step.

Q: What are the signs that an AI-assisted social engineering campaign is becoming dangerous?

A: Warning signs include prolonged back and forth contact, highly tailored references to a person’s hobbies or professional life, and a gradual shift from casual conversation to requests for information or action. Teams should also watch for rapid refinement of the attacker’s approach, repeated probing after resistance, and messages that appear unusually credible for an unknown contact.

Q: What should teams do when an agent can act faster than human review?

A: Move the control point earlier. If the assistant can read and act before review completes, enforce filtering, approval, and logging before the agent sees the message or reaches the action stage, because post-delivery review will be too late to stop the impact.

Technical breakdown

Agent vs agent social engineering

Agentic social engineering works by persuading one software-driven actor to take an action intended for another, often by exploiting the trust model around support channels, content surfaces, or delegated workflows. The attack is not only about content quality or prompt quality. It is about inducing a runtime decision that bypasses the guardrails humans normally apply, which means the control point shifts from user education to identity-bound authorisation, channel verification, and action validation.

Practical implication: validate who or what is allowed to initiate support, retrieval, or escalation actions before the request is executed.

LLM surface poisoning and credential theft

GEO and AEO poisoning attacks target the information surfaces that large language models consume, aiming to bias outputs, inject malicious links, or redirect users and agents toward credential theft. In this pattern, the model is not the final target alone. The real objective is to shape the trust path that leads a human or an agent to click, disclose, or authorise something that should have been blocked earlier in the chain.

Practical implication: monitor the content surfaces that feed AI-assisted search, summarisation, and support workflows for impersonation and credential-lure patterns.

Low-latency agents and security blind spots

AI personal assistant agents compress the time available for traditional detection and user review because they consume messages and act before slower controls can intervene. That latency problem creates a governance gap for both human and non-human identity: once the agent has already read, prioritised, and acted on the message, post-event review may be too late to contain the consequence. The issue is not just speed, but decision timing.

Practical implication: move controls earlier in the message-to-action path so high-risk prompts are filtered before the agent can operationalise them.

Threat narrative

Attacker objective: The attacker wants to manipulate trust so that a human or agent performs an action that enables fraud, credential theft, impersonation, or broader compromise.

1. Entry occurs through social interaction channels such as support calls, LLM surfaces, and email, where the attacker frames the request as trusted content or a legitimate workflow.
2. Credential theft or manipulation follows when the target, human or agent, is induced to click, disclose, or act on a malicious link or request.
3. Impact emerges as credential theft, impersonation, non-human insider activity, or agent-driven denial of service spreads through connected workflows.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Social engineering has become a cross-identity control problem, not a human awareness problem. The article shows that the manipulative objective stays the same whether the target is a person or an agent: induce trust and trigger action. That means awareness training alone cannot carry the programme, because machine-driven workflows can be manipulated without human hesitation ever entering the loop. Practitioners should treat social engineering as an identity governance issue across human and non-human actors.

Agent-directed deception exposes a new trust boundary that awareness programmes never had to defend. Agent vs agent phone calls and AI-assisted support interactions create a channel where the defender cannot assume a human will spot the cue. The control gap is not simply poor user judgement. It is the absence of verified identity, intent, and channel authenticity at the point where the agent decides to proceed. Teams should reclassify these interactions as governed execution paths, not informal conversations.

LLM surface poisoning creates credential-theft risk before the user or agent reaches the decision point. Once malicious content is embedded into search, summary, or recommendation surfaces, the attack operates upstream of conventional anti-phishing controls. This is a trust surface poisoning problem: the information layer itself becomes the attack vector. Practitioners need to treat AI-consumed content as part of the access path, not as a separate communications problem.

Low-latency AI assistants collapse the window in which traditional detection can still matter. When an agent reads and acts faster than conventional email or security review, the programme loses the assumption that humans will intervene before action. That changes governance from post-delivery inspection to pre-action policy enforcement. The implication is straightforward: if the workflow can execute faster than your review loop, your review loop is no longer the primary control.

The next social-engineering battlefield spans human-to-human, human-to-agent, and agent-to-agent interactions. That widens the identity perimeter materially, because the same trust manipulation tactic can now traverse multiple actor types in one attack chain. Security teams should stop treating AI agent compromise as a separate niche and start governing it as part of the enterprise social-engineering attack surface.

From our research library:

• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
• Read next: Agentic AI Security Guide

What this signals

Trust surface poisoning: When LLM-facing surfaces are manipulated, the compromise starts before the target reaches an obvious phishing event. That means security teams need to govern the content layer that feeds agent and human decisions, not only the mailbox or browser.

Agent-directed deception forces a rethink of awareness metrics. If an AI agent can be persuaded to call support, process mail, or act on poisoned content, the real question is whether your control framework can authenticate intent before the action is taken.

For practitioners

• Harden support-channel identity verification Require strong verification before any support interaction can trigger reset, escalation, or data-release actions, especially when an AI agent is involved in the conversation.
• Treat LLM-facing surfaces as a phishing domain Scan search, summarisation, and content-generation inputs for impersonation, malicious links, and credential-lure language, then block or warn before those surfaces are consumed by users or agents.
• Add pre-action controls for low-latency agents Insert policy checks before an assistant agent can process email, forward messages, or invoke downstream actions that may create fraud or credential-theft exposure.
• Extend social engineering testing to non-human identities Red-team both humans and agents across support, email, and content channels so you can see where trust manipulation succeeds without a person noticing.
• Classify agent interactions as governed workflows Define which agent actions require channel authentication, approval, or logging, and remove any assumption that an AI-driven request is lower risk because no person initiated it.

Key takeaways

• Social engineering now targets both humans and AI agents, so the trust boundary has expanded beyond classic phishing awareness.
• Agent-vs-agent calls, content poisoning, and low-latency assistant workflows create attack paths that traditional human-focused controls miss.
• The practical response is to verify identity and intent earlier in the workflow, before an agent can turn manipulation into action.

Key terms

• Agent-Directed Social Engineering: Social engineering that targets an AI agent or uses an AI agent as the delivery path instead of focusing only on the human user. The attacker’s goal is still to manipulate trust into action, but the defender must govern machine-driven decisions, not just user awareness.
• Trust Surface: The trust surface is the total area where an organisation must establish or maintain confidence in AI behaviour, outputs, and handling of data. It includes agents, models, content, and the systems that move information between them.
• Content Layer Poisoning: A manipulation pattern where adversarial content is inserted into the information sources consumed by AI systems or their users. The purpose is to bias what is retrieved, recommended, or acted on so that the next decision supports fraud, impersonation, or credential theft.
• Low-Latency Assistant Risk: The security exposure created when an AI assistant reads and acts before traditional controls or human review can intervene. The shorter the time between message intake and action, the less effective post-delivery inspection becomes as a primary control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.