How Attackers Use AI Agents and How Businesses Can Defend Against Them

Picture a small accounting firm on a Tuesday morning. A partner gets an email from a long-time client about updated wire instructions. It mentions last quarter's audit by name, refers to a scheduling mix-up the two of them joked about on a call, and ends with the client's usual sign-off. Nothing about it looks wrong.

That's because a program spent the previous night reading the client's public posts, a leaked mailbox thread, and the firm's own website before it wrote the message. Nobody sat at a keyboard crafting it. (This is a composite scenario, not a single real case, but every piece of it is already possible.)

That's the shift worth understanding. Attackers aren't inventing new crimes. They're using AI agents to do the old ones faster, cheaper, and with far more patience than any human criminal has.

What "AI agent" means in an attack context

A chatbot answers a question and stops. An agent is given a goal, then plans the steps, uses tools like a browser, a code runner or an email account, checks whether each step worked, and adjusts. If you want the basics of how these systems work, the AI Agent Store's learn about AI agents page covers them well.

Attackers use the same building blocks as everyone else. The difference is what they point them at. Most of what an attacking agent does, a person could do too. What changes is the economics. Work that took a skilled human a day now takes minutes, and it can run against thousands of targets at once. In practice, agents mostly speed up parts of an attack that a person still directs. Full autonomy from start to finish is rarer than the headlines suggest, but you don't need it to cause damage.

Where attackers are putting agents to work

Reconnaissance that never gets bored

Before an attack comes research: who works where, who approves payments, which vendors you use, what software your site runs, what your staff post about on LinkedIn. Agents collect and cross-reference this quickly. They can build a rough org chart of a 50-person company from public sources in the time it takes you to make coffee.

Phishing that reads like a colleague wrote it

The classic warning signs were broken grammar, generic greetings, and odd phrasing. Language models remove all three. Add the reconnaissance above and a message can reference real projects, real names, and real timing. Agents can also handle the back-and-forth. If you reply with a question, something can answer it convincingly, in character.

Credential attacks that adapt

Old credential stuffing hammered login pages with stolen passwords and got blocked quickly. Agents can vary their behavior: slow down, rotate through different patterns, and try likely password variations based on a person's public details. They can also drive a browser like a real user, which defeats some basic bot filters.

Finding and chaining weaknesses

Attackers use agents to scan for exposed services, forgotten test servers, unpatched software and leaked keys, then work out which small flaws combine into a real way in. The time between a vulnerability becoming public and someone trying it against you keeps shrinking. I'm keeping this general on purpose. The point isn't how it's done, it's that the window to patch is smaller than it used to be.

Voice and video impersonation

Cloned voices are already used in "urgent request from the boss" calls. A short audio sample from a conference talk or a video is often enough. The technique is crude but it works, mostly because it exploits pressure and hierarchy, not technology.

Going after your own agents

If your business uses AI agents that read email, browse the web, or connect to internal systems, those agents become targets. The best-known attack is prompt injection: hiding instructions in a web page, document or email that the agent reads and then obeys. It has topped OWASP's list of risks for LLM applications, and the OWASP AI Agent Security Cheat Sheet explains how injected instructions can hijack agent behavior. Google Cloud's security team has described the same problem with a simple example: an agent that summarizes email gets fed a crafted message and leaks confidential information to the wrong person.

A quick reference

Why the old advice feels weaker

"Look for spelling mistakes" doesn't work anymore. Neither does "be suspicious of messages that aren't personal." Volume matters too. When an attacker's cost per attempt drops to almost nothing, they can afford a lower success rate and still profit. That's why small businesses are in the frame. They have fewer people watching, weaker processes, and money that moves through the same handful of accounts.

The good news is that the defenses that work haven't changed much. They're mostly about process and permissions, not clever tools.

Defenses that hold up

Make identity hard to steal

Passwords alone are the weak link, and even standard one-time codes can be phished in real time. Where you can, move to passkeys or hardware security keys for email, finance and admin accounts. Set shorter session lifetimes on sensitive systems, and turn on alerts for new devices and new mailbox forwarding rules. Forwarding rules are a favorite way to quietly watch a compromised inbox.

Verify money and access requests outside the channel they arrived on

This is the cheapest control on the list and it stops a lot. Any request to change bank details, send a payment, reset access, or share sensitive files gets confirmed by calling a number you already have on file, not the one in the message. Add a second approver above a set amount. Write it down as a rule that applies even when the "CEO" is traveling and it's urgent. Especially then. Urgency is the tell.

Keep your own agents on a short leash

If you're deploying agents, treat them like a new employee with a very literal mind. Give each one only the permissions its job requires. Separate reading from writing, so an agent that summarizes documents can't also send email. Require human sign-off for anything irreversible, like payments, deletions or external sharing. Log every tool call so you can reconstruct what happened. And treat anything from outside (web pages, inbound email, uploaded files) as untrusted input, because that's where injected instructions hide. The AI Agent Store's guide to 8 AI agent policies every team should adopt is a useful starting point for writing these rules down.

Watch behavior, not just known bad signatures

Adaptive attacks slip past filters that look for known patterns, so watch what accounts do. Flag impossible travel, logins at odd hours, sudden bulk downloads, and unusual API usage. Put sensible rate limits on login and API endpoints. None of this needs an expensive platform to start. Most email and identity providers include the basics, and they're often switched off by default.

Protect the connection your people work over

Remote and travelling staff regularly work from cafés, airports, hotels and shared workspaces. On those networks, traffic can be watched or tampered with, and attackers know it. Running work traffic through a secure VPN encrypts the connection between the device and the network beyond the local Wi-Fi, which makes interception on untrusted networks much harder.

Be realistic about what it does, though. A VPN doesn't stop someone from clicking a phishing link or entering a password on a fake login page. It protects data in transit. Think of it as one layer for the connection, sitting alongside MFA, device updates, and staff training, not a substitute for them.

Test the way an attacker would

You can read about threats all day, but you won't know how your own setup holds up until someone tries to break it. Penetration Testing is the closest thing you have to a dress rehearsal. Skilled testers try to get in the way a real attacker would, then show you exactly what worked.

Scope matters. If you've adopted AI agents, make sure the test covers them: what tools they can call, what data they can reach, and whether a crafted message can push them off script. Include a phishing simulation and a check for exposed keys and forgotten services too. Run tests after major changes, like launching a new app, moving infrastructure, or connecting an agent to internal systems, not only on a fixed calendar. Then actually fix what they find and retest. A report nobody acts on is just an expensive PDF.

Rehearse the bad day

Pick a Friday afternoon scenario, such as a fraudulent wire that already went out or an agent that emailed a customer list to the wrong address. Walk through who does what. Who can freeze payments? Who calls the bank? Who talks to customers? Do you have offline backups you've actually tested? A one-hour tabletop exercise exposes gaps that no policy document will.

Final Thoughts

AI agents haven't given attackers a magic weapon. They've made the old playbook cheaper and faster: research a target, write a convincing message, try the credentials, and move on to the next target if it doesn't work. What used to take a skilled criminal a day can now run overnight against thousands of businesses.