"Attackers exploit the trust relationship between humans and AI agents — either by manipulating agent outputs to bypass human scrutiny, by using agents as intermediaries to deliver manipulative content to humans, or by designing systems that create miscalibrated trust (both over-trust and under-trust) in ways that undermine effective human oversight and enable unauthorized or harmful actions."

"Attackers exploit the trust relationship between humans and AI agents" — The trust relationship itself is the attack surface. An attacker who understands that humans defer to a specific agent's recommendations can exploit that deference, even when the agent itself is not compromised — by crafting their attack to exploit the agent's known limitations.

"By manipulating agent outputs to bypass human scrutiny" — When the agent says "low risk," the human skips independent investigation. Crafting an attack to receive a "low risk" verdict from the agent is a novel attack vector that has no analog in systems without AI involvement.

"By using agents as intermediaries to deliver manipulative content to humans" — An AI agent's output carries an implicit "AI-vetted" credibility halo. Attackers can exploit this by routing social engineering content through an agent, causing the human to receive attacker-controlled content with apparent AI endorsement.

"By designing systems that create miscalibrated trust" — Poor agent design (suppressing uncertainty, projecting false confidence, creating dependency) can itself be the root cause of the exploitable gap — even without any external attacker involvement.

"That undermine effective human oversight" — The net effect is that the human's capacity to catch errors — their own and the agent's — is compromised. This is the core harm: degradation of the oversight function that is supposed to be the last line of defense.