AI SecurityIncident ResponseAI Agents
The most useful thing about Barracuda's latest red-team exercise is what it didn't do. It didn't find a Copilot vulnerability. It didn't escalate privileges, bypass a permission boundary, or trick a model into ignoring its instructions. It logged into a Microsoft 365 account with valid stolen credentials and then simply asked the AI assistant sitting inside that account for help.
Nine steps later, a $247,500 wire transfer had been redirected to an attacker-controlled bank account, and the emails proving it had been deleted.
The research was published on August 4 by Barracuda's Red Team and detailed at Black Hat 2026. Its framing is the part security teams should sit with: an AI-enabled email account is an insider threat waiting for someone else's credentials.
What makes the proof-of-concept worth reading in full is how mundane each individual step is. Every one of them is something a patient human attacker could have done manually. Copilot just did them in seconds, correctly, on the first try.
Barracuda's own summary is the line to quote in your next steering meeting: the AI assistant "effectively acts as a knowledgeable insider, helping attackers identify sensitive information, understand organizational relationships, target privileged users, and execute fraud."
The standard response to an AI security finding is to reach for guardrails: constrain the model, filter the prompts, restrict the tools. None of that applies here, because nothing the attacker asked Copilot to do was outside what that account was already permitted to do. Reading your own mail, creating your own inbox rules, drafting your own messages — that is the product working as designed.
That collapses two defensive assumptions at once.
The first is that MFA is the account-takeover backstop. Step five spends a session token, not a password. Adversary-in-the-middle phishing has been commodity tooling for years, and the CEO in this scenario did everything right by the old rules.
The second, more consequential assumption is that attacker dwell time buys defenders room. Historically, the window between compromise and fraud was filled with slow, error-prone human work: reading threads, learning names, guessing at approval chains, writing English convincing enough to survive a finance team's scrutiny. That labour was our margin. An assistant with full mailbox context erases it. The privileges didn't change; the speed and precision with which they can be converted into money did.
This is the same asymmetry we covered in autonomous AI attacks operating at machine speed — except here the accelerant isn't attacker-built tooling. It's software the victim organisation bought, deployed, and pays for.
If prevention can't distinguish this attack from legitimate use, detection has to. And the encouraging detail buried in the chain is that it is noisy — in logs, if not to the user.
Nearly every step writes an audit record. Inbox rule creation is logged. Rules that specifically suppress security notifications or forward externally are logged and are strongly anomalous. Session tokens replayed from a new location, new device, and impossible-travel geography are logged. Bulk message deletion is logged. Barracuda's own recommendation lands exactly here: monitor AI-enabled accounts, inbox rule abuse patterns, and anomalous session activity.
The problem is not that the evidence is missing. It is that the evidence lands in a mailbox audit log nobody correlates, at 2 a.m., as four separate low-severity events that only mean something together — and the reply-to-the-CFO deadline is measured in hours.
An attack that generates no policy violations and no exploit signatures is a detection-and-correlation problem, which is what Obiguard SOC is built for.
Microsoft 365 and Entra ID audit logs stream in through the same Splunk HEC-compatible ingestion path SOC uses for everything else — Vector, Fluentd, or Logstash, no dashboard-building project first — and land in Live Logs searchable alongside your infrastructure and application telemetry. That matters here specifically: the inbox rule, the token replay, and the deletion sweep are only a story when they sit on one timeline.
From there the design targets the exact failure mode above. Correlation is the point, not the alert count — SOC exists because a dozen uncorrelated tools bury the incident that matters, and this chain is four quiet events in three different places. Every alert arrives with an AI-written executive summary, an explanation of business impact, and a remediation plan split into act now / this week / long-term, so the 2 a.m. finding doesn't wait for an analyst to reconstruct it from raw events. Each one keeps a full evidence timeline linked back to the raw log lines that triggered it — which is also what you hand the bank, the auditor, and your insurer when the question becomes what exactly happened, and when. And predictive risk scoring flags escalating, watching, and cooling signals per source, rather than waiting for a threshold to trip after the wire has cleared.
Worth being precise about the boundary: SOC does not sit in front of Copilot, and no product on the market makes a compromised account behave. What it changes is how long the four events stay separate. In Barracuda's scenario, that interval is the entire attack.
If your AI assistants have full mailbox context and your mailbox audit logs go somewhere nobody reads, you already have the exposure — the credentials are the only missing ingredient. Launch SOC or talk to us about getting your identity and mail audit logs onto the same timeline as the rest of your environment.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →