Cybersecurity Awareness Month traditionally focuses on teaching employees how to recognize social engineering efforts and how to avoid consequences associated with business email compromise (BEC). But as companies give AI agents authority to interact with business systems, threat actors can target AI agents and manipulate them into taking authorized actions instead — which should reshape how organizations train on BEC attacks.
Consider a classic BEC scenario: an accounts-payable employee receives what appears to be a legitimate message from a vendor saying its banking information has changed. The employee believes the request and, using their own legitimate access, redirects a future payment to an attacker-controlled account. The attacker must convince an employee with authority to take the wrong action.
But if an agent is already authorized to take privileged action, the attacker may not need a person to achieve the desired outcome. Through prompt injection and feeding malicious content to a third-party AI tool, attackers can steal sensitive data to later pull as an extortion lever, redirect invoice funds, or gain a foothold in a corporate environment to exploit for more persistent access later. In a BEC-like scenario, an attacker can convince a third-party AI agent to change vendor information or manipulate where payments end up.
According to Verizon's 2026 Data Breach Investigations Report, third parties were involved in 48% of breaches, a 60% increase year over year. This happens as organizations increasingly connect AI applications to the platforms and APIs that run core business processes.
And meanwhile, BEC remains a costly enterprise threat. The FBI's Internet Crime Complaint Center recorded roughly $3 billion in reported BEC losses in 2025, making it the second-costliest crime category tracked by IC3 behind investment fraud. Phishing and spoofing, meanwhile, remained among the most frequently reported cybercrimes.