Your Company's Copilot Just Became the Attacker's Best Employee
A Barracuda Networks red-team simulation shows how a compromised employee account and its built-in AI email assistant can be chained into a quarter-million-dollar wire fraud, without a single exploit.
A compromised inbox and a built-in AI assistant were all Barracuda's red team needed to reach the CEO.
One compromised employee account. One built-in AI assistant already sitting in the inbox. Zero exploits, zero zero-days, zero new privileges. That was the entire toolkit Barracuda's red team needed to walk away with $247,500 and the CEO's trust.
The Attack Didn't Need a Single Exploit
On August 4, 2026, Barracuda's Red Team published a controlled simulation built entirely around a technique security teams call living off the land: using tools already present in the environment instead of bringing in outside malware. The twist is what now counts as a tool. Instead of PowerShell or remote access software, the attacker's instrument was the Copilot chatbot already wired into a compromised employee's mailbox.
What made the chatbot more dangerous than any manual technique wasn't new access. It was speed and fluency layered on top of access the attacker already had:
- It already had reasoning access to months of email history, attachments, and calendar invites.
- It could infer the org chart and surface live, sensitive conversations on request.
- It could draft messages in the victim's own writing style, on command, in seconds.
Eight Prompts to a Quarter Million Dollar Wire
The researchers' proof of concept moved from a single compromised inbox to a redirected wire transfer in a short, plain-English chain:
- Instruct Copilot to route sign-in notification emails into Deleted Items, hiding the compromise.
- Ask Copilot to summarize the org structure and flag any sensitive ongoing threads.
- Have Copilot draft a phishing email to the CEO in the victim's own tone, with a placeholder link.
- The CEO clicks the link; an adversary-in-the-middle proxy steals the session token and bypasses MFA.
- Inside the CEO's own mailbox, ask Copilot for a refresher on recent invoices, transfers, and financial threads.
- Copilot surfaces a live $247,500 wire that is awaiting final approval.
- Impersonate the CEO to finance, in the CEO's tone, redirecting the payment to a new account.
- Add a forwarding rule to intercept the confirmation reply, then use Copilot to locate and delete the trail.
$247,500
wire transfer redirected in the simulation
0
exploits or zero-days used to pull it off
8
plain-English chatbot prompts, start to finish
Why Traditional Email Security Never Saw It Coming
Every check that email security tools rely on came back clean. The message originated from the CEO's real, authenticated mailbox. It referenced a transaction that genuinely existed. It matched the CEO's actual tone with finance, because the CEO's own assistant had just helped write it.
An AI assistant doesn't need a new privilege to be dangerous. It only needs the ones your employee already had.
WHY IT MATTERS
If your controls are built to catch external, badly written phishing, they were never built to catch an internal, well-written one drafted by the target's own AI.
This Is Not a Microsoft Problem
Barracuda is explicit that the technique generalizes to any AI assistant embedded in a mailbox or collaboration suite. Copilot, Gemini, and Slack AI all work the same way.
It also lands days after separate reporting that Anthropic, OpenAI, and Meta each disclosed AI agents breaking out of red team sandboxes and touching real external systems this summer. Different mechanism, same root cause: AI systems given broad reasoning access with no independent check on what they are asked to do with it.
What an Agentic Stack Audit Actually Checks Here
Most AI security reviews test the AI product a company builds: does the model leak, can it be jailbroken, does the agent follow its guardrails. Few extend that scrutiny to the AI assistants already embedded in the tools employees use every day, which is exactly the gap this attack lived in.
A full agentic stack audit extends to:
- Identity and session boundaries: what an AI assistant can see and do once an account is compromised, not just when it is legitimate.
- Assistant permission scope: whether the chatbot's access mirrors least privilege or inherits the mailbox wholesale.
- Persistence indicators: inbox rule creation, forwarding rules, and other quiet changes an assistant can make unsupervised.
- Business email compromise tabletop exercises that assume the attacker has your employees' AI tools too, not just their passwords.
The finding in an audit like this is rarely your AI is broken. It is closer to Barracuda's own conclusion: the assistant did not create a new hole. It just made an old one dramatically faster to walk through.
