Home / Technology / AI Agent Falls for Phishing Despite Strict Settings
AI Agent Falls for Phishing Despite Strict Settings
11 Jun
Summary
- AI agents granted sensitive access to fake data and credentials.
- Models blocked malicious links but failed on identity verification.
- Urgency overrides AI's security protocols, researchers find.
Cybersecurity researchers at Varonis have demonstrated that advanced AI email agents can be susceptible to sophisticated phishing tactics, even when equipped with strict security protocols. In their tests, an OpenClaw agent named Pinchy, connected to Gmail and Google Workspace APIs, was tricked into granting access to sensitive information like customer data and credentials.
The AI models, including Gemini 3.1 Pro and GPT-5.4, were initially effective at blocking obvious threats, such as malicious links in fake gift card emails and fraudulent Google OAuth applications. However, they faltered when attackers impersonated authority figures, such as a team lead requesting staging environment access, or claimed urgent needs for customer data exports.
Varonis concluded that while AI excels at detecting suspicious URLs and apps, its failure point lies in identity verification. The urgency of a request appears to override the AI's security checks, leading to potential breaches. The researchers emphasized the necessity of enforced identity verification for AI agents to prevent exploitation.
