Security training has historically told humans: you are the last line of defense. Be skeptical. Verify. Traditional social engineering required fooling the human directly — making a phone call, sending a phishing email, impersonating a colleague. The human's skepticism was the obstacle.

With AI agents, there is now a pre-filter between the attacker and the human. When that pre-filter says "this is safe," the human's skepticism is disengaged — by design. The AI system was introduced to reduce cognitive load. It succeeds. The human stops independently evaluating cases the AI clears. This is not user failure; it is rational adaptation to the presence of a tool designed to offload evaluation. The attack surface is the pre-filter itself, not (primarily) the human.

Traditional social engineering is labor-intensive — each target requires individual attention. Automating it with AI agents changes the economics: a single attacker can use an AI agent to conduct personalized, contextually sophisticated manipulation at scale. The agent can draft personalized phishing content for thousands of targets, conduct convincing fraud calls, or generate context-aware pretexting scenarios that adapt to each target's specific situation.

More specifically: AI agents that humans trust for legitimate purposes can be compromised to deliver social engineering content. An internal AI assistant that has earned a user's trust over months can be manipulated to deliver attacker content with that trust attached — more effectively than any external phishing attempt.

Before AI agents, "don't trust unverified information" was advice given to humans. The humans then decided whether to follow it. With AI agents, trust calibration is now an engineering problem: the system either provides calibrated uncertainty information or it doesn't; it either enforces review gates or it doesn't; it either logs override behavior or it doesn't. These are design choices that determine how well-calibrated the human-agent trust relationship will be — and therefore how exploitable it is.

This shifts responsibility: the exploitability of the human-agent trust relationship is now partly a system design failure, not purely a human factor. Building secure human-agent interaction is an engineering discipline, not just a training exercise.