2026’s AI-Phishing Problem Is Moving Past Email Filters

On March 2, 2021, Microsoft disclosed ProxyLogon, the Exchange Server chain behind CVE-2021-26855 and friends, after attackers had already been using it at scale against tens of thousands of U.S. organizations. The interesting part wasn’t just the SSRF-to-RCE trick; it was how fast exploitation went from niche to industrial once the path was public. AI phishing is following the same pattern: find a lure that works, tune it quickly, and scale it before your controls finish logging the first hit.

Kratikal’s warning about 2026 being the year of AI-based cyberattacks is directionally right, but the real shift is narrower and nastier. Static email filters were built for broad patterns: bad domains, obvious spoofing, sloppy grammar, and known-bad attachments. AI-assisted phishing doesn’t need to look broadly malicious. It only needs to look plausible to one person, at one moment, with one credential prompt. That’s a different game, and “we have a filter” is not a defense strategy. It’s a comfort blanket.

Static email filters fail when every lure is custom

Barracuda’s 2023 ESG zero-day, CVE-2023-2868, was a reminder that attackers love paths defenders don’t expect, and UNC4841 proved they can operationalize them fast. AI phishing follows the same logic, except the payload is social, not software. A model can generate a finance thread that matches your vendor’s tone, your CEO’s writing quirks, and your payroll cycle. Proofpoint, Microsoft Defender for Office 365, and Google Workspace security can still catch commodity junk. They’re much less useful when the message is unique, timely, and internally consistent.

Identity is the real target, not the inbox

Phishing has always been about stealing a session, a token, or a reset flow. That hasn’t changed. If an attacker gets a valid Okta session token, a Microsoft Entra ID login, or a Google Workspace OAuth grant, your email gateway has already lost the argument. T-Mobile’s repeated breaches from 2021 through 2023 showed how credential abuse and API access can turn into recurring pain. The defense is boring on purpose: phishing-resistant MFA, conditional access, least privilege, and session revocation that works in minutes, not after the postmortem.

Human verification beats “looks legit” every time

AI improves timing as much as wording. A convincing invoice request sent five minutes after a real vendor call is far more dangerous than a generic spoof. That’s why out-of-band verification still matters: call-backs to known numbers, approval in a separate channel, and step-up checks for wire changes, password resets, and OAuth consent. Most compliance frameworks will happily document this and still miss the breach. If your process lets a single email move money or grant access, you’ve outsourced trust to a mailbox. Brave choice. Usually expensive.

Red-team your AI workflows before attackers do it for you

If you’ve added copilots, ticket summarizers, chatbots, or AI email assistants, you’ve expanded the attack surface whether procurement admitted it or not. Prompt injection, malicious document ingestion, and workflow abuse are already showing up in real assessments, and the problem gets worse when those systems can send mail, create tickets, or approve actions. Test the integrations, not the demo. Microsoft, OpenAI, and Google all ship useful tools, but your guardrails are only as good as your logging, segmentation, and permission boundaries. Audit logs are boring. They’re also what you read after the breach.

Bottom line

2026 won’t be ugly because spam got better. It’ll be uglier because phishing will be precise, timely, and tied to identity abuse before your static controls can catch up. If your defense stack still treats phishing as an email problem, you’re already behind.

Do three things now: deploy phishing-resistant MFA and tight conditional access, require out-of-band verification for money movement and access changes, and test every AI-enabled workflow for prompt injection, malicious input, and overbroad permissions. Then make sure session revocation, logging, and least privilege actually work in practice. If you don’t red-team those paths yourself, an attacker will do the QA for you later.