Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
Yes, with a human signing off.
An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached. What it shouldn’t do yet is act on that verdict unchecked, because attackers are already hiding instructions inside phishing emails meant for the AI doing the reading.
The evidence for both halves of that answer is now public. Microsoft’s randomized trial of 167 security analysts found that its phishing triage agent made them faster and more accurate. Barracuda reported on Oct. 7, that one phishing email can carry a lure for the human and a hidden prompt for the AI in the same message.
This post walks through what an agentic investigation of a real phishing campaign looks like, evidence item by evidence item, using the lookalike Microsoft Teams domains that researcher Steven Lim exposed in October. Then it covers where agents break, and what to ask before you trust one.
What is an agentic AI security investigation?
An agentic AI security investigation is one where an AI agent plans and runs the investigation itself. It decides which data sources to query, calls the tools, reads what comes back, chooses the next step and stops when it can support a verdict with evidence a human can check. The phrase “agentic AI security” also gets used for protecting AI agents from attack. This post is about the other direction: agents doing the investigating.
The difference from older automation is who picks the next step. A SOAR playbook runs the same steps every time. A chat assistant answers the question an analyst types. An agent sets its own path based on what it finds, which is exactly what makes it useful and exactly what makes it attackable.
| SOAR playbook | AI chat assistant | AI investigation agent | |
| Who picks the next step | The playbook author, in advance | The analyst, one prompt at a time | The agent, based on each result |
| What it produces | Enrichment fields and tickets | Answers and summaries | A verdict with an evidence trail |
| Typical failure | Breaks on anything off-script | Only as good as the questions asked | Can be steered by content it reads |
What the evidence says so far
The best public data comes from Microsoft. In November 2025, Microsoft economist James Bono published a randomized controlled trial of the Security Copilot Phishing Triage Agent. Microsoft recruited 167 professional security analysts and split them into groups that triaged a 25-email queue of real, privacy-vetted user-reported emails, 20% of them malicious, with or without the agent.
Analysts working with the agent found up to 6.5 times as many true positives per minute and were up to 77% more accurate, measured by F1 score. They also spent 53% more time on the malicious emails. The paper found no sign they simply rubber-stamped the agent’s calls.
Read the fine print before quoting those numbers in a budget meeting. Microsoft studied its own product. On the test corpus, the agent’s precision and recall were both 100%, which no production deployment should expect, and the paper’s own scenario with a less accurate agent and more malicious mail cut the accuracy gain to 48%. The trial also measured triage: one reported email, one verdict. Investigating a campaign means connecting dozens of artifacts across days, and no comparable trial covers that yet.
The skeptical data point comes from Gartner. In June 2025, Gartner predicted that more than 40% of agentic AI projects will be canceled by the end of 2027 over costs, unclear value or weak risk controls. It estimated that only about 130 of the thousands of vendors marketing agentic AI offer real agentic capabilities, calling the rest “agent washing.”
Put together: agents have measurable value on narrow, high-volume phishing work, and plenty of products wearing the label won’t deliver it. The way to tell them apart is to watch one work a real case.
Evidence walkthrough: investigating the fake Teams portals
In October 2026, Microsoft Security MVP Steven Lim posted a series of lookalike Microsoft Teams domains on LinkedIn, with screenshots. They make a good test case because the attack never needed a phishing email, so an inbox-only investigation would have missed most of it.
Below is the evidence chain an investigation agent should build from that same starting point, one step at a time. It reconstructs the work from the artifacts Lim made public; it is not output from a specific product run. Each step names what the agent does, what it collects and where a human should check.
Step 1: Enrich the seed domain
The seed is teams-online[.]com. The agent pulls registration data and reputation in parallel. Lim’s screenshot gives the answers: registered Oct. 4, 2026, through a privacy service attached to the registrar Global Domain Group, and no active verdict in Microsoft Defender threat intelligence.
A lazy agent stops here and calls the domain clean. A good one treats “no verdict” on a four-day-old domain as missing data, not a pass, and weighs what it does know: brand name in the domain, days old, owner hidden.
Human check: none yet. This is enrichment, and it’s cheap to be wrong here.
Step 2: Render the page safely and compare it to the real thing
The agent opens the URL in an isolated browser and captures a screenshot, the page source and the assets it loads. The page is a near-copy of the Teams pre-join screen: camera preview, audio options, a “Meeting with the Design team” heading, Sign in and Need help links.
The evidence that matters is the comparison. The agent should record which brand assets appear, how closely the layout matches the real join page and whether the page asks for anything (a name, credentials, a download).
Human check: confirm the brand match. Visual similarity scoring can flag a legitimate partner page that embeds a Teams meeting.
Step 3: Pivot to sibling infrastructure
One domain is an incident. Several are a campaign. The agent searches for domains that share traits with the seed: the “teams-” plus generic-word naming pattern, the registrar, hosting, TLS certificates and page templates.
Lim’s later posts surface two siblings. teams-livemeeting[.]com shared the registrar Global Domain Group, was about 15 days old and was flagged by 3 of 92 vendors in a domain scan. teams-cloud[.]live copied the same Teams join page and was five days old.
This is where agents most often overreach. A registrar serves many unrelated customers, so a shared registrar alone proves little. A careful agent links siblings on stronger evidence, such as shared IP addresses, certificate details, identical page code or tracking IDs, and labels each link with its confidence. Lim describes the domains as registered by the same organization; the agent should attribute that claim to him until its own evidence supports it.
Human check: review every link the agent marks as “same actor” before anyone writes that in a report.
Step 4: Trace how victims reach the pages
An email-centered workflow looks for the message that delivered the link. Here there may be no message. Lim reported that teams-livemeeting[.]com surfaced through sponsored search ads and an AI-generated answer, and his screenshot shows a search engine’s AI overview citing it beside Microsoft’s own links. A later post shows teams-cloud[.]live ranking second in ordinary results for “teams cloud live.”
The agent should capture these delivery paths as evidence too: the search queries, the ad or result position and the date seen. For practitioners, this maps to MITRE ATT&CK T1583.001 (acquiring domains) and T1608.006 (SEO poisoning).
Human check: none for collection. The findings feed the response plan.
Step 5: Follow the payload path without detonating blindly
On teams-cloud[.]live, joining the meeting led to a fake “You need to update Microsoft Teams” prompt. The Update Teams button downloaded a file named realtek-demo.txt.
The agent records the filename, hash and file type, and notes that a text file can’t execute on its own. The honest verdict is “staged lure, payload not yet weaponized or swapped per visitor,” not “malware delivery.” Overstating this step is how investigation reports lose credibility.
Human check: decide whether to detonate further, for example by revisiting from a different region or browser profile, since some kits serve payloads selectively.
Step 6: Write the verdict and the response plan
The output should be a verdict a person can audit in five minutes: three lookalike Teams domains, cloned join pages, delivery through search and ads, a staged fake update, and a confidence level for each claim.
The response plan follows from the evidence: block the domains in DNS and web filtering, which is what Lim advised; search proxy and DNS logs for any visits from your users; file takedown requests with the registrar and host; and add the naming pattern to watch lists.
Human check: approve every action that touches production or goes outside the company. Blocks are reversible. A takedown request filed under your company’s name is not.
The evidence ledger
This is what the finished case file should contain, and what you should expect any agent to show you.
| Evidence item | Source | What it shows | Confidence |
| teams-online[.]com registered Oct. 4, 2026, privacy-protected | Registration record | New, ownership hidden | High |
| No threat intelligence verdict for teams-online[.]com | Microsoft Defender | Reputation gap, not a clean bill | High |
| Cloned Teams pre-join page on all three domains | Rendered page captures | Brand impersonation | High |
| teams-livemeeting[.]com: same registrar, about 15 days old, 3 of 92 vendors flagged | Domain scan | Possible sibling, weak link on registrar alone | Medium |
| teams-livemeeting[.]com cited in an AI search answer | Search screenshot | Delivery without email | High that it appeared; unknown how widely |
| teams-cloud[.]live ranked second in organic results | Search screenshot | Delivery through search | High that it appeared |
| Fake update prompt downloading realtek-demo.txt | Page capture | Staged lure, no executable observed | High |
| All three run by one organization | Lim’s assessment | Campaign attribution | Unverified until infrastructure links confirm |
Where AI investigation agents break
The walkthrough has the agent reading attacker-controlled pages at every step. That is the core weakness, and attackers have already found it.
Barracuda reported on Oct. 7, that phishing emails in one campaign carried a password-protected attachment for the human and hidden instructions for the AI assistant that summarizes the inbox. Sublime Security documented phishing emails stuffed with invisible text copied from real Adidas newsletters and romance novels, meant to push AI filters toward a benign verdict. StrongestLayer found a malicious file carrying an “LLM_IGNORE_START” comment aimed at AI scanners. Sublime’s researchers put the hidden-text technique at under 1% of phishing traffic, so this is early. It is also exactly the input an investigation agent consumes.
Three other failure modes show up in practice:
- Overconfident links. Step 3 is where agents turn a shared registrar into “the same threat actor.” A claim without an evidence item behind it should never reach a report.
- Missing business context. An agent doesn’t know that your marketing team runs a microsite on a hyphenated domain, or which vendor portals your staff use.
- Too much permission. An agent that can file takedowns or change firewall rules on its own turns one poisoned page into an outage or a legal letter.
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
Yes, with a human signing off.
An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached. What it shouldn’t do yet is act on that verdict unchecked, because attackers are already hiding instructions inside phishing emails meant for the AI doing the reading.
The evidence for both halves of that answer is now public. Microsoft’s randomized trial of 167 security analysts found that its phishing triage agent made them faster and more accurate. Barracuda reported on Oct. 7, that one phishing email can carry a lure for the human and a hidden prompt for the AI in the same message.
This post walks through what an agentic investigation of a real phishing campaign looks like, evidence item by evidence item, using the lookalike Microsoft Teams domains that researcher Steven Lim exposed in October. Then it covers where agents break, and what to ask before you trust one.
What is an agentic AI security investigation?
An agentic AI security investigation is one where an AI agent plans and runs the investigation itself. It decides which data sources to query, calls the tools, reads what comes back, chooses the next step and stops when it can support a verdict with evidence a human can check. The phrase “agentic AI security” also gets used for protecting AI agents from attack. This post is about the other direction: agents doing the investigating.
The difference from older automation is who picks the next step. A SOAR playbook runs the same steps every time. A chat assistant answers the question an analyst types. An agent sets its own path based on what it finds, which is exactly what makes it useful and exactly what makes it attackable.
| SOAR playbook | AI chat assistant | AI investigation agent | |
| Who picks the next step | The playbook author, in advance | The analyst, one prompt at a time | The agent, based on each result |
| What it produces | Enrichment fields and tickets | Answers and summaries | A verdict with an evidence trail |
| Typical failure | Breaks on anything off-script | Only as good as the questions asked | Can be steered by content it reads |
What the evidence says so far
The best public data comes from Microsoft. In November 2025, Microsoft economist James Bono published a randomized controlled trial of the Security Copilot Phishing Triage Agent. Microsoft recruited 167 professional security analysts and split them into groups that triaged a 25-email queue of real, privacy-vetted user-reported emails, 20% of them malicious, with or without the agent.
Analysts working with the agent found up to 6.5 times as many true positives per minute and were up to 77% more accurate, measured by F1 score. They also spent 53% more time on the malicious emails. The paper found no sign they simply rubber-stamped the agent’s calls.
Read the fine print before quoting those numbers in a budget meeting. Microsoft studied its own product. On the test corpus, the agent’s precision and recall were both 100%, which no production deployment should expect, and the paper’s own scenario with a less accurate agent and more malicious mail cut the accuracy gain to 48%. The trial also measured triage: one reported email, one verdict. Investigating a campaign means connecting dozens of artifacts across days, and no comparable trial covers that yet.
The skeptical data point comes from Gartner. In June 2025, Gartner predicted that more than 40% of agentic AI projects will be canceled by the end of 2027 over costs, unclear value or weak risk controls. It estimated that only about 130 of the thousands of vendors marketing agentic AI offer real agentic capabilities, calling the rest “agent washing.”
Put together: agents have measurable value on narrow, high-volume phishing work, and plenty of products wearing the label won’t deliver it. The way to tell them apart is to watch one work a real case.
Evidence walkthrough: investigating the fake Teams portals
In October 2026, Microsoft Security MVP Steven Lim posted a series of lookalike Microsoft Teams domains on LinkedIn, with screenshots. They make a good test case because the attack never needed a phishing email, so an inbox-only investigation would have missed most of it.
Below is the evidence chain an investigation agent should build from that same starting point, one step at a time. It reconstructs the work from the artifacts Lim made public; it is not output from a specific product run. Each step names what the agent does, what it collects and where a human should check.
Step 1: Enrich the seed domain
The seed is teams-online[.]com. The agent pulls registration data and reputation in parallel. Lim’s screenshot gives the answers: registered Oct. 4, 2026, through a privacy service attached to the registrar Global Domain Group, and no active verdict in Microsoft Defender threat intelligence.
A lazy agent stops here and calls the domain clean. A good one treats “no verdict” on a four-day-old domain as missing data, not a pass, and weighs what it does know: brand name in the domain, days old, owner hidden.
Human check: none yet. This is enrichment, and it’s cheap to be wrong here.
Step 2: Render the page safely and compare it to the real thing
The agent opens the URL in an isolated browser and captures a screenshot, the page source and the assets it loads. The page is a near-copy of the Teams pre-join screen: camera preview, audio options, a “Meeting with the Design team” heading, Sign in and Need help links.
The evidence that matters is the comparison. The agent should record which brand assets appear, how closely the layout matches the real join page and whether the page asks for anything (a name, credentials, a download).
Human check: confirm the brand match. Visual similarity scoring can flag a legitimate partner page that embeds a Teams meeting.
Step 3: Pivot to sibling infrastructure
One domain is an incident. Several are a campaign. The agent searches for domains that share traits with the seed: the “teams-” plus generic-word naming pattern, the registrar, hosting, TLS certificates and page templates.
Lim’s later posts surface two siblings. teams-livemeeting[.]com shared the registrar Global Domain Group, was about 15 days old and was flagged by 3 of 92 vendors in a domain scan. teams-cloud[.]live copied the same Teams join page and was five days old.
This is where agents most often overreach. A registrar serves many unrelated customers, so a shared registrar alone proves little. A careful agent links siblings on stronger evidence, such as shared IP addresses, certificate details, identical page code or tracking IDs, and labels each link with its confidence. Lim describes the domains as registered by the same organization; the agent should attribute that claim to him until its own evidence supports it.
Human check: review every link the agent marks as “same actor” before anyone writes that in a report.
Step 4: Trace how victims reach the pages
An email-centered workflow looks for the message that delivered the link. Here there may be no message. Lim reported that teams-livemeeting[.]com surfaced through sponsored search ads and an AI-generated answer, and his screenshot shows a search engine’s AI overview citing it beside Microsoft’s own links. A later post shows teams-cloud[.]live ranking second in ordinary results for “teams cloud live.”
The agent should capture these delivery paths as evidence too: the search queries, the ad or result position and the date seen. For practitioners, this maps to MITRE ATT&CK T1583.001 (acquiring domains) and T1608.006 (SEO poisoning).
Human check: none for collection. The findings feed the response plan.
Step 5: Follow the payload path without detonating blindly
On teams-cloud[.]live, joining the meeting led to a fake “You need to update Microsoft Teams” prompt. The Update Teams button downloaded a file named realtek-demo.txt.
The agent records the filename, hash and file type, and notes that a text file can’t execute on its own. The honest verdict is “staged lure, payload not yet weaponized or swapped per visitor,” not “malware delivery.” Overstating this step is how investigation reports lose credibility.
Human check: decide whether to detonate further, for example by revisiting from a different region or browser profile, since some kits serve payloads selectively.
Step 6: Write the verdict and the response plan
The output should be a verdict a person can audit in five minutes: three lookalike Teams domains, cloned join pages, delivery through search and ads, a staged fake update, and a confidence level for each claim.
The response plan follows from the evidence: block the domains in DNS and web filtering, which is what Lim advised; search proxy and DNS logs for any visits from your users; file takedown requests with the registrar and host; and add the naming pattern to watch lists.
Human check: approve every action that touches production or goes outside the company. Blocks are reversible. A takedown request filed under your company’s name is not.
The evidence ledger
This is what the finished case file should contain, and what you should expect any agent to show you.
| Evidence item | Source | What it shows | Confidence |
| teams-online[.]com registered Oct. 4, 2026, privacy-protected | Registration record | New, ownership hidden | High |
| No threat intelligence verdict for teams-online[.]com | Microsoft Defender | Reputation gap, not a clean bill | High |
| Cloned Teams pre-join page on all three domains | Rendered page captures | Brand impersonation | High |
| teams-livemeeting[.]com: same registrar, about 15 days old, 3 of 92 vendors flagged | Domain scan | Possible sibling, weak link on registrar alone | Medium |
| teams-livemeeting[.]com cited in an AI search answer | Search screenshot | Delivery without email | High that it appeared; unknown how widely |
| teams-cloud[.]live ranked second in organic results | Search screenshot | Delivery through search | High that it appeared |
| Fake update prompt downloading realtek-demo.txt | Page capture | Staged lure, no executable observed | High |
| All three run by one organization | Lim’s assessment | Campaign attribution | Unverified until infrastructure links confirm |
Where AI investigation agents break
The walkthrough has the agent reading attacker-controlled pages at every step. That is the core weakness, and attackers have already found it.
Barracuda reported on Oct. 7, that phishing emails in one campaign carried a password-protected attachment for the human and hidden instructions for the AI assistant that summarizes the inbox. Sublime Security documented phishing emails stuffed with invisible text copied from real Adidas newsletters and romance novels, meant to push AI filters toward a benign verdict. StrongestLayer found a malicious file carrying an “LLM_IGNORE_START” comment aimed at AI scanners. Sublime’s researchers put the hidden-text technique at under 1% of phishing traffic, so this is early. It is also exactly the input an investigation agent consumes.
Three other failure modes show up in practice:
- Overconfident links. Step 3 is where agents turn a shared registrar into “the same threat actor.” A claim without an evidence item behind it should never reach a report.
- Missing business context. An agent doesn’t know that your marketing team runs a microsite on a hyphenated domain, or which vendor portals your staff use.
- Too much permission. An agent that can file takedowns or change firewall rules on its own turns one poisoned page into an outage or a legal letter.
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
Yes, with a human signing off.
An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached. What it shouldn’t do yet is act on that verdict unchecked, because attackers are already hiding instructions inside phishing emails meant for the AI doing the reading.
The evidence for both halves of that answer is now public. Microsoft’s randomized trial of 167 security analysts found that its phishing triage agent made them faster and more accurate. Barracuda reported on Oct. 7, that one phishing email can carry a lure for the human and a hidden prompt for the AI in the same message.
This post walks through what an agentic investigation of a real phishing campaign looks like, evidence item by evidence item, using the lookalike Microsoft Teams domains that researcher Steven Lim exposed in October. Then it covers where agents break, and what to ask before you trust one.
What is an agentic AI security investigation?
An agentic AI security investigation is one where an AI agent plans and runs the investigation itself. It decides which data sources to query, calls the tools, reads what comes back, chooses the next step and stops when it can support a verdict with evidence a human can check. The phrase “agentic AI security” also gets used for protecting AI agents from attack. This post is about the other direction: agents doing the investigating.
The difference from older automation is who picks the next step. A SOAR playbook runs the same steps every time. A chat assistant answers the question an analyst types. An agent sets its own path based on what it finds, which is exactly what makes it useful and exactly what makes it attackable.
| SOAR playbook | AI chat assistant | AI investigation agent | |
| Who picks the next step | The playbook author, in advance | The analyst, one prompt at a time | The agent, based on each result |
| What it produces | Enrichment fields and tickets | Answers and summaries | A verdict with an evidence trail |
| Typical failure | Breaks on anything off-script | Only as good as the questions asked | Can be steered by content it reads |
What the evidence says so far
The best public data comes from Microsoft. In November 2025, Microsoft economist James Bono published a randomized controlled trial of the Security Copilot Phishing Triage Agent. Microsoft recruited 167 professional security analysts and split them into groups that triaged a 25-email queue of real, privacy-vetted user-reported emails, 20% of them malicious, with or without the agent.
Analysts working with the agent found up to 6.5 times as many true positives per minute and were up to 77% more accurate, measured by F1 score. They also spent 53% more time on the malicious emails. The paper found no sign they simply rubber-stamped the agent’s calls.
Read the fine print before quoting those numbers in a budget meeting. Microsoft studied its own product. On the test corpus, the agent’s precision and recall were both 100%, which no production deployment should expect, and the paper’s own scenario with a less accurate agent and more malicious mail cut the accuracy gain to 48%. The trial also measured triage: one reported email, one verdict. Investigating a campaign means connecting dozens of artifacts across days, and no comparable trial covers that yet.
The skeptical data point comes from Gartner. In June 2025, Gartner predicted that more than 40% of agentic AI projects will be canceled by the end of 2027 over costs, unclear value or weak risk controls. It estimated that only about 130 of the thousands of vendors marketing agentic AI offer real agentic capabilities, calling the rest “agent washing.”
Put together: agents have measurable value on narrow, high-volume phishing work, and plenty of products wearing the label won’t deliver it. The way to tell them apart is to watch one work a real case.
Evidence walkthrough: investigating the fake Teams portals
In October 2026, Microsoft Security MVP Steven Lim posted a series of lookalike Microsoft Teams domains on LinkedIn, with screenshots. They make a good test case because the attack never needed a phishing email, so an inbox-only investigation would have missed most of it.
Below is the evidence chain an investigation agent should build from that same starting point, one step at a time. It reconstructs the work from the artifacts Lim made public; it is not output from a specific product run. Each step names what the agent does, what it collects and where a human should check.
Step 1: Enrich the seed domain
The seed is teams-online[.]com. The agent pulls registration data and reputation in parallel. Lim’s screenshot gives the answers: registered Oct. 4, 2026, through a privacy service attached to the registrar Global Domain Group, and no active verdict in Microsoft Defender threat intelligence.
A lazy agent stops here and calls the domain clean. A good one treats “no verdict” on a four-day-old domain as missing data, not a pass, and weighs what it does know: brand name in the domain, days old, owner hidden.
Human check: none yet. This is enrichment, and it’s cheap to be wrong here.
Step 2: Render the page safely and compare it to the real thing
The agent opens the URL in an isolated browser and captures a screenshot, the page source and the assets it loads. The page is a near-copy of the Teams pre-join screen: camera preview, audio options, a “Meeting with the Design team” heading, Sign in and Need help links.
The evidence that matters is the comparison. The agent should record which brand assets appear, how closely the layout matches the real join page and whether the page asks for anything (a name, credentials, a download).
Human check: confirm the brand match. Visual similarity scoring can flag a legitimate partner page that embeds a Teams meeting.
Step 3: Pivot to sibling infrastructure
One domain is an incident. Several are a campaign. The agent searches for domains that share traits with the seed: the “teams-” plus generic-word naming pattern, the registrar, hosting, TLS certificates and page templates.
Lim’s later posts surface two siblings. teams-livemeeting[.]com shared the registrar Global Domain Group, was about 15 days old and was flagged by 3 of 92 vendors in a domain scan. teams-cloud[.]live copied the same Teams join page and was five days old.
This is where agents most often overreach. A registrar serves many unrelated customers, so a shared registrar alone proves little. A careful agent links siblings on stronger evidence, such as shared IP addresses, certificate details, identical page code or tracking IDs, and labels each link with its confidence. Lim describes the domains as registered by the same organization; the agent should attribute that claim to him until its own evidence supports it.
Human check: review every link the agent marks as “same actor” before anyone writes that in a report.
Step 4: Trace how victims reach the pages
An email-centered workflow looks for the message that delivered the link. Here there may be no message. Lim reported that teams-livemeeting[.]com surfaced through sponsored search ads and an AI-generated answer, and his screenshot shows a search engine’s AI overview citing it beside Microsoft’s own links. A later post shows teams-cloud[.]live ranking second in ordinary results for “teams cloud live.”
The agent should capture these delivery paths as evidence too: the search queries, the ad or result position and the date seen. For practitioners, this maps to MITRE ATT&CK T1583.001 (acquiring domains) and T1608.006 (SEO poisoning).
Human check: none for collection. The findings feed the response plan.
Step 5: Follow the payload path without detonating blindly
On teams-cloud[.]live, joining the meeting led to a fake “You need to update Microsoft Teams” prompt. The Update Teams button downloaded a file named realtek-demo.txt.
The agent records the filename, hash and file type, and notes that a text file can’t execute on its own. The honest verdict is “staged lure, payload not yet weaponized or swapped per visitor,” not “malware delivery.” Overstating this step is how investigation reports lose credibility.
Human check: decide whether to detonate further, for example by revisiting from a different region or browser profile, since some kits serve payloads selectively.
Step 6: Write the verdict and the response plan
The output should be a verdict a person can audit in five minutes: three lookalike Teams domains, cloned join pages, delivery through search and ads, a staged fake update, and a confidence level for each claim.
The response plan follows from the evidence: block the domains in DNS and web filtering, which is what Lim advised; search proxy and DNS logs for any visits from your users; file takedown requests with the registrar and host; and add the naming pattern to watch lists.
Human check: approve every action that touches production or goes outside the company. Blocks are reversible. A takedown request filed under your company’s name is not.
The evidence ledger
This is what the finished case file should contain, and what you should expect any agent to show you.
| Evidence item | Source | What it shows | Confidence |
| teams-online[.]com registered Oct. 4, 2026, privacy-protected | Registration record | New, ownership hidden | High |
| No threat intelligence verdict for teams-online[.]com | Microsoft Defender | Reputation gap, not a clean bill | High |
| Cloned Teams pre-join page on all three domains | Rendered page captures | Brand impersonation | High |
| teams-livemeeting[.]com: same registrar, about 15 days old, 3 of 92 vendors flagged | Domain scan | Possible sibling, weak link on registrar alone | Medium |
| teams-livemeeting[.]com cited in an AI search answer | Search screenshot | Delivery without email | High that it appeared; unknown how widely |
| teams-cloud[.]live ranked second in organic results | Search screenshot | Delivery through search | High that it appeared |
| Fake update prompt downloading realtek-demo.txt | Page capture | Staged lure, no executable observed | High |
| All three run by one organization | Lim’s assessment | Campaign attribution | Unverified until infrastructure links confirm |
Where AI investigation agents break
The walkthrough has the agent reading attacker-controlled pages at every step. That is the core weakness, and attackers have already found it.
Barracuda reported on Oct. 7, that phishing emails in one campaign carried a password-protected attachment for the human and hidden instructions for the AI assistant that summarizes the inbox. Sublime Security documented phishing emails stuffed with invisible text copied from real Adidas newsletters and romance novels, meant to push AI filters toward a benign verdict. StrongestLayer found a malicious file carrying an “LLM_IGNORE_START” comment aimed at AI scanners. Sublime’s researchers put the hidden-text technique at under 1% of phishing traffic, so this is early. It is also exactly the input an investigation agent consumes.
Three other failure modes show up in practice:
- Overconfident links. Step 3 is where agents turn a shared registrar into “the same threat actor.” A claim without an evidence item behind it should never reach a report.
- Missing business context. An agent doesn’t know that your marketing team runs a microsite on a hyphenated domain, or which vendor portals your staff use.
- Too much permission. An agent that can file takedowns or change firewall rules on its own turns one poisoned page into an outage or a legal letter.
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
Yes, with a human signing off.
An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached. What it shouldn’t do yet is act on that verdict unchecked, because attackers are already hiding instructions inside phishing emails meant for the AI doing the reading.
The evidence for both halves of that answer is now public. Microsoft’s randomized trial of 167 security analysts found that its phishing triage agent made them faster and more accurate. Barracuda reported on Oct. 7, that one phishing email can carry a lure for the human and a hidden prompt for the AI in the same message.
This post walks through what an agentic investigation of a real phishing campaign looks like, evidence item by evidence item, using the lookalike Microsoft Teams domains that researcher Steven Lim exposed in October. Then it covers where agents break, and what to ask before you trust one.
What is an agentic AI security investigation?
An agentic AI security investigation is one where an AI agent plans and runs the investigation itself. It decides which data sources to query, calls the tools, reads what comes back, chooses the next step and stops when it can support a verdict with evidence a human can check. The phrase “agentic AI security” also gets used for protecting AI agents from attack. This post is about the other direction: agents doing the investigating.
The difference from older automation is who picks the next step. A SOAR playbook runs the same steps every time. A chat assistant answers the question an analyst types. An agent sets its own path based on what it finds, which is exactly what makes it useful and exactly what makes it attackable.
| SOAR playbook | AI chat assistant | AI investigation agent | |
| Who picks the next step | The playbook author, in advance | The analyst, one prompt at a time | The agent, based on each result |
| What it produces | Enrichment fields and tickets | Answers and summaries | A verdict with an evidence trail |
| Typical failure | Breaks on anything off-script | Only as good as the questions asked | Can be steered by content it reads |
What the evidence says so far
The best public data comes from Microsoft. In November 2025, Microsoft economist James Bono published a randomized controlled trial of the Security Copilot Phishing Triage Agent. Microsoft recruited 167 professional security analysts and split them into groups that triaged a 25-email queue of real, privacy-vetted user-reported emails, 20% of them malicious, with or without the agent.
Analysts working with the agent found up to 6.5 times as many true positives per minute and were up to 77% more accurate, measured by F1 score. They also spent 53% more time on the malicious emails. The paper found no sign they simply rubber-stamped the agent’s calls.
Read the fine print before quoting those numbers in a budget meeting. Microsoft studied its own product. On the test corpus, the agent’s precision and recall were both 100%, which no production deployment should expect, and the paper’s own scenario with a less accurate agent and more malicious mail cut the accuracy gain to 48%. The trial also measured triage: one reported email, one verdict. Investigating a campaign means connecting dozens of artifacts across days, and no comparable trial covers that yet.
The skeptical data point comes from Gartner. In June 2025, Gartner predicted that more than 40% of agentic AI projects will be canceled by the end of 2027 over costs, unclear value or weak risk controls. It estimated that only about 130 of the thousands of vendors marketing agentic AI offer real agentic capabilities, calling the rest “agent washing.”
Put together: agents have measurable value on narrow, high-volume phishing work, and plenty of products wearing the label won’t deliver it. The way to tell them apart is to watch one work a real case.
Evidence walkthrough: investigating the fake Teams portals
In October 2026, Microsoft Security MVP Steven Lim posted a series of lookalike Microsoft Teams domains on LinkedIn, with screenshots. They make a good test case because the attack never needed a phishing email, so an inbox-only investigation would have missed most of it.
Below is the evidence chain an investigation agent should build from that same starting point, one step at a time. It reconstructs the work from the artifacts Lim made public; it is not output from a specific product run. Each step names what the agent does, what it collects and where a human should check.
Step 1: Enrich the seed domain
The seed is teams-online[.]com. The agent pulls registration data and reputation in parallel. Lim’s screenshot gives the answers: registered Oct. 4, 2026, through a privacy service attached to the registrar Global Domain Group, and no active verdict in Microsoft Defender threat intelligence.
A lazy agent stops here and calls the domain clean. A good one treats “no verdict” on a four-day-old domain as missing data, not a pass, and weighs what it does know: brand name in the domain, days old, owner hidden.
Human check: none yet. This is enrichment, and it’s cheap to be wrong here.
Step 2: Render the page safely and compare it to the real thing
The agent opens the URL in an isolated browser and captures a screenshot, the page source and the assets it loads. The page is a near-copy of the Teams pre-join screen: camera preview, audio options, a “Meeting with the Design team” heading, Sign in and Need help links.
The evidence that matters is the comparison. The agent should record which brand assets appear, how closely the layout matches the real join page and whether the page asks for anything (a name, credentials, a download).
Human check: confirm the brand match. Visual similarity scoring can flag a legitimate partner page that embeds a Teams meeting.
Step 3: Pivot to sibling infrastructure
One domain is an incident. Several are a campaign. The agent searches for domains that share traits with the seed: the “teams-” plus generic-word naming pattern, the registrar, hosting, TLS certificates and page templates.
Lim’s later posts surface two siblings. teams-livemeeting[.]com shared the registrar Global Domain Group, was about 15 days old and was flagged by 3 of 92 vendors in a domain scan. teams-cloud[.]live copied the same Teams join page and was five days old.
This is where agents most often overreach. A registrar serves many unrelated customers, so a shared registrar alone proves little. A careful agent links siblings on stronger evidence, such as shared IP addresses, certificate details, identical page code or tracking IDs, and labels each link with its confidence. Lim describes the domains as registered by the same organization; the agent should attribute that claim to him until its own evidence supports it.
Human check: review every link the agent marks as “same actor” before anyone writes that in a report.
Step 4: Trace how victims reach the pages
An email-centered workflow looks for the message that delivered the link. Here there may be no message. Lim reported that teams-livemeeting[.]com surfaced through sponsored search ads and an AI-generated answer, and his screenshot shows a search engine’s AI overview citing it beside Microsoft’s own links. A later post shows teams-cloud[.]live ranking second in ordinary results for “teams cloud live.”
The agent should capture these delivery paths as evidence too: the search queries, the ad or result position and the date seen. For practitioners, this maps to MITRE ATT&CK T1583.001 (acquiring domains) and T1608.006 (SEO poisoning).
Human check: none for collection. The findings feed the response plan.
Step 5: Follow the payload path without detonating blindly
On teams-cloud[.]live, joining the meeting led to a fake “You need to update Microsoft Teams” prompt. The Update Teams button downloaded a file named realtek-demo.txt.
The agent records the filename, hash and file type, and notes that a text file can’t execute on its own. The honest verdict is “staged lure, payload not yet weaponized or swapped per visitor,” not “malware delivery.” Overstating this step is how investigation reports lose credibility.
Human check: decide whether to detonate further, for example by revisiting from a different region or browser profile, since some kits serve payloads selectively.
Step 6: Write the verdict and the response plan
The output should be a verdict a person can audit in five minutes: three lookalike Teams domains, cloned join pages, delivery through search and ads, a staged fake update, and a confidence level for each claim.
The response plan follows from the evidence: block the domains in DNS and web filtering, which is what Lim advised; search proxy and DNS logs for any visits from your users; file takedown requests with the registrar and host; and add the naming pattern to watch lists.
Human check: approve every action that touches production or goes outside the company. Blocks are reversible. A takedown request filed under your company’s name is not.
The evidence ledger
This is what the finished case file should contain, and what you should expect any agent to show you.
| Evidence item | Source | What it shows | Confidence |
| teams-online[.]com registered Oct. 4, 2026, privacy-protected | Registration record | New, ownership hidden | High |
| No threat intelligence verdict for teams-online[.]com | Microsoft Defender | Reputation gap, not a clean bill | High |
| Cloned Teams pre-join page on all three domains | Rendered page captures | Brand impersonation | High |
| teams-livemeeting[.]com: same registrar, about 15 days old, 3 of 92 vendors flagged | Domain scan | Possible sibling, weak link on registrar alone | Medium |
| teams-livemeeting[.]com cited in an AI search answer | Search screenshot | Delivery without email | High that it appeared; unknown how widely |
| teams-cloud[.]live ranked second in organic results | Search screenshot | Delivery through search | High that it appeared |
| Fake update prompt downloading realtek-demo.txt | Page capture | Staged lure, no executable observed | High |
| All three run by one organization | Lim’s assessment | Campaign attribution | Unverified until infrastructure links confirm |
Where AI investigation agents break
The walkthrough has the agent reading attacker-controlled pages at every step. That is the core weakness, and attackers have already found it.
Barracuda reported on Oct. 7, that phishing emails in one campaign carried a password-protected attachment for the human and hidden instructions for the AI assistant that summarizes the inbox. Sublime Security documented phishing emails stuffed with invisible text copied from real Adidas newsletters and romance novels, meant to push AI filters toward a benign verdict. StrongestLayer found a malicious file carrying an “LLM_IGNORE_START” comment aimed at AI scanners. Sublime’s researchers put the hidden-text technique at under 1% of phishing traffic, so this is early. It is also exactly the input an investigation agent consumes.
Three other failure modes show up in practice:
- Overconfident links. Step 3 is where agents turn a shared registrar into “the same threat actor.” A claim without an evidence item behind it should never reach a report.
- Missing business context. An agent doesn’t know that your marketing team runs a microsite on a hyphenated domain, or which vendor portals your staff use.
- Too much permission. An agent that can file takedowns or change firewall rules on its own turns one poisoned page into an outage or a legal letter.
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12
Yes, with a human signing off.
An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached. What it shouldn’t do yet is act on that verdict unchecked, because attackers are already hiding instructions inside phishing emails meant for the AI doing the reading.
The evidence for both halves of that answer is now public. Microsoft’s randomized trial of 167 security analysts found that its phishing triage agent made them faster and more accurate. Barracuda reported on Oct. 7, that one phishing email can carry a lure for the human and a hidden prompt for the AI in the same message.
This post walks through what an agentic investigation of a real phishing campaign looks like, evidence item by evidence item, using the lookalike Microsoft Teams domains that researcher Steven Lim exposed in October. Then it covers where agents break, and what to ask before you trust one.
What is an agentic AI security investigation?
An agentic AI security investigation is one where an AI agent plans and runs the investigation itself. It decides which data sources to query, calls the tools, reads what comes back, chooses the next step and stops when it can support a verdict with evidence a human can check. The phrase “agentic AI security” also gets used for protecting AI agents from attack. This post is about the other direction: agents doing the investigating.
The difference from older automation is who picks the next step. A SOAR playbook runs the same steps every time. A chat assistant answers the question an analyst types. An agent sets its own path based on what it finds, which is exactly what makes it useful and exactly what makes it attackable.
| SOAR playbook | AI chat assistant | AI investigation agent | |
| Who picks the next step | The playbook author, in advance | The analyst, one prompt at a time | The agent, based on each result |
| What it produces | Enrichment fields and tickets | Answers and summaries | A verdict with an evidence trail |
| Typical failure | Breaks on anything off-script | Only as good as the questions asked | Can be steered by content it reads |
What the evidence says so far
The best public data comes from Microsoft. In November 2025, Microsoft economist James Bono published a randomized controlled trial of the Security Copilot Phishing Triage Agent. Microsoft recruited 167 professional security analysts and split them into groups that triaged a 25-email queue of real, privacy-vetted user-reported emails, 20% of them malicious, with or without the agent.
Analysts working with the agent found up to 6.5 times as many true positives per minute and were up to 77% more accurate, measured by F1 score. They also spent 53% more time on the malicious emails. The paper found no sign they simply rubber-stamped the agent’s calls.
Read the fine print before quoting those numbers in a budget meeting. Microsoft studied its own product. On the test corpus, the agent’s precision and recall were both 100%, which no production deployment should expect, and the paper’s own scenario with a less accurate agent and more malicious mail cut the accuracy gain to 48%. The trial also measured triage: one reported email, one verdict. Investigating a campaign means connecting dozens of artifacts across days, and no comparable trial covers that yet.
The skeptical data point comes from Gartner. In June 2025, Gartner predicted that more than 40% of agentic AI projects will be canceled by the end of 2027 over costs, unclear value or weak risk controls. It estimated that only about 130 of the thousands of vendors marketing agentic AI offer real agentic capabilities, calling the rest “agent washing.”
Put together: agents have measurable value on narrow, high-volume phishing work, and plenty of products wearing the label won’t deliver it. The way to tell them apart is to watch one work a real case.
Evidence walkthrough: investigating the fake Teams portals
In October 2026, Microsoft Security MVP Steven Lim posted a series of lookalike Microsoft Teams domains on LinkedIn, with screenshots. They make a good test case because the attack never needed a phishing email, so an inbox-only investigation would have missed most of it.
Below is the evidence chain an investigation agent should build from that same starting point, one step at a time. It reconstructs the work from the artifacts Lim made public; it is not output from a specific product run. Each step names what the agent does, what it collects and where a human should check.
Step 1: Enrich the seed domain
The seed is teams-online[.]com. The agent pulls registration data and reputation in parallel. Lim’s screenshot gives the answers: registered Oct. 4, 2026, through a privacy service attached to the registrar Global Domain Group, and no active verdict in Microsoft Defender threat intelligence.
A lazy agent stops here and calls the domain clean. A good one treats “no verdict” on a four-day-old domain as missing data, not a pass, and weighs what it does know: brand name in the domain, days old, owner hidden.
Human check: none yet. This is enrichment, and it’s cheap to be wrong here.
Step 2: Render the page safely and compare it to the real thing
The agent opens the URL in an isolated browser and captures a screenshot, the page source and the assets it loads. The page is a near-copy of the Teams pre-join screen: camera preview, audio options, a “Meeting with the Design team” heading, Sign in and Need help links.
The evidence that matters is the comparison. The agent should record which brand assets appear, how closely the layout matches the real join page and whether the page asks for anything (a name, credentials, a download).
Human check: confirm the brand match. Visual similarity scoring can flag a legitimate partner page that embeds a Teams meeting.
Step 3: Pivot to sibling infrastructure
One domain is an incident. Several are a campaign. The agent searches for domains that share traits with the seed: the “teams-” plus generic-word naming pattern, the registrar, hosting, TLS certificates and page templates.
Lim’s later posts surface two siblings. teams-livemeeting[.]com shared the registrar Global Domain Group, was about 15 days old and was flagged by 3 of 92 vendors in a domain scan. teams-cloud[.]live copied the same Teams join page and was five days old.
This is where agents most often overreach. A registrar serves many unrelated customers, so a shared registrar alone proves little. A careful agent links siblings on stronger evidence, such as shared IP addresses, certificate details, identical page code or tracking IDs, and labels each link with its confidence. Lim describes the domains as registered by the same organization; the agent should attribute that claim to him until its own evidence supports it.
Human check: review every link the agent marks as “same actor” before anyone writes that in a report.
Step 4: Trace how victims reach the pages
An email-centered workflow looks for the message that delivered the link. Here there may be no message. Lim reported that teams-livemeeting[.]com surfaced through sponsored search ads and an AI-generated answer, and his screenshot shows a search engine’s AI overview citing it beside Microsoft’s own links. A later post shows teams-cloud[.]live ranking second in ordinary results for “teams cloud live.”
The agent should capture these delivery paths as evidence too: the search queries, the ad or result position and the date seen. For practitioners, this maps to MITRE ATT&CK T1583.001 (acquiring domains) and T1608.006 (SEO poisoning).
Human check: none for collection. The findings feed the response plan.
Step 5: Follow the payload path without detonating blindly
On teams-cloud[.]live, joining the meeting led to a fake “You need to update Microsoft Teams” prompt. The Update Teams button downloaded a file named realtek-demo.txt.
The agent records the filename, hash and file type, and notes that a text file can’t execute on its own. The honest verdict is “staged lure, payload not yet weaponized or swapped per visitor,” not “malware delivery.” Overstating this step is how investigation reports lose credibility.
Human check: decide whether to detonate further, for example by revisiting from a different region or browser profile, since some kits serve payloads selectively.
Step 6: Write the verdict and the response plan
The output should be a verdict a person can audit in five minutes: three lookalike Teams domains, cloned join pages, delivery through search and ads, a staged fake update, and a confidence level for each claim.
The response plan follows from the evidence: block the domains in DNS and web filtering, which is what Lim advised; search proxy and DNS logs for any visits from your users; file takedown requests with the registrar and host; and add the naming pattern to watch lists.
Human check: approve every action that touches production or goes outside the company. Blocks are reversible. A takedown request filed under your company’s name is not.
The evidence ledger
This is what the finished case file should contain, and what you should expect any agent to show you.
| Evidence item | Source | What it shows | Confidence |
| teams-online[.]com registered Oct. 4, 2026, privacy-protected | Registration record | New, ownership hidden | High |
| No threat intelligence verdict for teams-online[.]com | Microsoft Defender | Reputation gap, not a clean bill | High |
| Cloned Teams pre-join page on all three domains | Rendered page captures | Brand impersonation | High |
| teams-livemeeting[.]com: same registrar, about 15 days old, 3 of 92 vendors flagged | Domain scan | Possible sibling, weak link on registrar alone | Medium |
| teams-livemeeting[.]com cited in an AI search answer | Search screenshot | Delivery without email | High that it appeared; unknown how widely |
| teams-cloud[.]live ranked second in organic results | Search screenshot | Delivery through search | High that it appeared |
| Fake update prompt downloading realtek-demo.txt | Page capture | Staged lure, no executable observed | High |
| All three run by one organization | Lim’s assessment | Campaign attribution | Unverified until infrastructure links confirm |
Where AI investigation agents break
The walkthrough has the agent reading attacker-controlled pages at every step. That is the core weakness, and attackers have already found it.
Barracuda reported on Oct. 7, that phishing emails in one campaign carried a password-protected attachment for the human and hidden instructions for the AI assistant that summarizes the inbox. Sublime Security documented phishing emails stuffed with invisible text copied from real Adidas newsletters and romance novels, meant to push AI filters toward a benign verdict. StrongestLayer found a malicious file carrying an “LLM_IGNORE_START” comment aimed at AI scanners. Sublime’s researchers put the hidden-text technique at under 1% of phishing traffic, so this is early. It is also exactly the input an investigation agent consumes.
Three other failure modes show up in practice:
- Overconfident links. Step 3 is where agents turn a shared registrar into “the same threat actor.” A claim without an evidence item behind it should never reach a report.
- Missing business context. An agent doesn’t know that your marketing team runs a microsite on a hyphenated domain, or which vendor portals your staff use.
- Too much permission. An agent that can file takedowns or change firewall rules on its own turns one poisoned page into an outage or a legal letter.
The defenses are design choices you can ask about. Treat everything the agent fetches as data, never as instructions. Separate the permission to read from the permission to act. Require every claim in a verdict to point to an evidence item. Log every tool call so the investigation can be replayed. Keep a human approval step on anything that leaves the building.
Seven questions to ask before you trust an investigation agent
Gartner’s agent-washing estimate means most demos will look impressive. These questions separate an agent that investigates from a chatbot with a playbook behind it.
- Show me the evidence ledger for a real case. Every claim in the verdict should link to an artifact: a record, a screenshot, a log line.
- What does it do with a domain that has no reputation yet? If the answer is “marks it clean,” it would have passed teams-online[.]com.
- Can it investigate beyond the inbox? Lookalike domain registrations, search results and ads are delivery channels now. An email-only agent sees part of the campaign.
- How does it separate content from instructions? Ask what happens when a phishing page or email contains hidden text addressed to the AI.
- What can it do without human approval? Get the list in writing. Read-only enrichment can be automatic. Blocks, takedowns and user notifications need a person.
- Can we replay an investigation? You need every query and tool call logged, so an analyst or auditor can retrace the path.
- What is its accuracy on our data? Vendor benchmarks are best cases; in Microsoft’s trial, the agent was 100% accurate on the test corpus. Run a pilot on your own reported phishing and measure false positives and misses yourself.
Frequently asked questions
Can AI agents investigate phishing on their own?
AI agents can gather and correlate most of the evidence in a phishing investigation on their own, including domain records, page captures, related infrastructure and indicators. They should not take outward-facing actions such as takedowns or blocks without human approval, because attackers can plant instructions in the content agents read.
How accurate are AI phishing triage agents?
In Microsoft’s randomized trial with 167 analysts, people working with the Security Copilot Phishing Triage Agent were up to 77% more accurate and found up to 6.5 times as many true positives per minute. The agent was 100% accurate on that test corpus, so expect lower numbers in production and measure on your own data.
Is agentic AI different from SOAR for phishing response?
Yes. A SOAR playbook runs fixed steps written in advance. An AI agent chooses its next step based on what it finds, so it can follow a lead like a sibling domain that no playbook anticipated. That flexibility is also why agents need evidence logging and approval controls.
What is the biggest risk of AI agents in security investigations?
Prompt injection. An investigation agent reads attacker-controlled emails and web pages, and researchers at Barracuda, Sublime Security and StrongestLayer have documented phishing content with hidden text aimed at AI systems. The fix is design: treat fetched content as data, limit what the agent can do without approval and log every step.
Will AI investigation agents replace SOC analysts?
The evidence points to a shift in analyst work rather than replacement. In Microsoft’s trial, analysts with the agent spent 53% more time on the malicious emails, because the agent handled sorting and first-pass reasoning. Judgment calls on attribution, business context and response still sat with people.
Watch an agent work a real case
The fake Teams portals show where investigation work has moved. The evidence sat in domain registrations, cloned pages, search results and an AI answer. An agent that only reads the inbox would have seen a fraction of it, and an agent that can’t show its evidence shouldn’t be trusted with the rest.
Blaze AI is Cyble’s agentic engine, and it runs across the company’s threat intelligence and digital risk protection products, where this kind of outside-in evidence lives. Cyble describes Blaze as correlating threat intelligence and digital risk signals, extracting indicators, and producing decisions that are explainable and auditable. The useful test is the one in this post: give it a seed, watch it build the evidence ledger and see where it asks a human to decide.
Get a Blaze AI walkthrough and bring a phishing case of your own.
Sources
- James Bono, Microsoft, Randomized Controlled Trials for Phishing Triage Agent, arXiv
- Gartner, Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027
- Infosecurity Magazine, Attackers Hide AI Prompt Injections Inside Phishing Emails
- Hackread, Scammers Use Hidden Text to Bypass AI Email Filters in Phishing Scams
- SC Media, Malicious email with prompt injection targets AI-based scanners
- Steven Lim, LinkedIn posts on teams-online[.]com, teams-livemeeting[.]com and teams-cloud[.]live, October 2026: 1, 2, 3, 4
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-12