Editor's note — September 12, 2026: Replaced unsupported platform-specific trend comparisons with explicitly illustrative scenarios. The linked CISA reference supports phishing-resistant MFA, not claims about named AI providers.
The New Phishing Risk Is Trust in AI Itself
THE TAKE
AI-themed phishing is a scenario worth including in security testing. Employees encouraged to explore new AI tools may encounter unfamiliar installers, invitations and account notices.
For example, an attacker could imitate an AI service's billing notice or distribute a lookalike installer. These are illustrative scenarios, not claims that a named provider has been compromised or that these messages outperform other phishing lures.
That creates a board-level problem. AI adoption is now tied to security behavior. If the company is pushing employees to experiment with AI but has not clearly defined approved tools, safe access paths, and modern phishing controls, then the organization is training people to trust the very patterns attackers are exploiting. My view: AI adoption without AI-specific security guardrails is not transformation. It is exposure.
THREE THINGS BOARDS SHOULD KNOW
Test AI-themed lures — Include lookalike services and unapproved installers in awareness and detection exercises.
Update awareness material — Show employees how to reach approved tools and report suspicious invitations.
Governance and security must be joined — The safest AI programs make approved use easy, risky use visible, and malicious use harder to execute.
THE QUESTION I'M HEARING
"Is this really a new risk, or just phishing with an AI label?"
It is both. The mechanics may look familiar, but the business context has changed. Traditional phishing exploited fear, urgency, or routine business process. AI-themed phishing exploits strategic pressure. Employees know leadership wants AI adoption. Developers know new tools are emerging quickly. Executives know competitors are moving. That creates a perfect environment for attackers to package malicious links and downloads as innovation.
The recommendation is direct: boards should ask whether management has an AI-safe access model. That means a published list of approved AI tools, blocked lookalike domains, controls around newly registered domains, stronger protection for privileged users, phishing-resistant MFA where practical, and monitoring for suspicious AI-related downloads and sign-ins.
This also needs to show up in board reporting. I would not want a CISO only reporting phishing click rates from generic training campaigns. I would want to know whether AI-themed attacks are increasing, whether employees are attempting to use unapproved AI tools, whether sensitive data is being pasted into public platforms, and whether security tooling can detect malicious AI impersonation campaigns.
The deeper issue is culture. If leadership says “go use AI” but does not define safe use, employees will improvise. Some will choose the wrong tool. Some will click the wrong link. Some will install the wrong plugin. Security then becomes the cleanup crew for an adoption strategy that was never properly governed.
THE BOTTOM LINE
AI trust is now part of the attack surface. Boards should make sure the company’s AI adoption strategy includes security controls strong enough for the behavior it is encouraging.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.