AI-era threats playbook

Spot attacks that use AI, or that target a company's AI tools, and judge them by the evidence like any other alert.

Use this when: A chatbot or AI assistant doing something it should not, a voice or video request for money, a flawless phishing email, an unapproved AI tool, or a stolen AI key.

Steps

0 of 6 ticked

1. Say what the AI was or didWas AI the attacker's tool (a fake voice, a well-written email) or the target (a chatbot, an assistant, an API key)? The answer decides what you check.
2. Find what it could reachFor a company AI tool, list the data and actions it is allowed to use: mailboxes, files, customer records, payments. The risk is whatever it can touch.
3. Look for instructions hidden in dataPrompt injection means text in a message, web page or document that tells the AI to do something. Read the input the AI saw, not only what it did.
4. Verify the person or the request outside the channelFor voice, video or urgent money requests, confirm through a known phone number or a second approver. A convincing voice is not proof.
5. Follow the usage and the moneyFor stolen AI keys, check usage by region, time and volume against normal, and look at billing.
6. Contain and hand overDisable the key or the tool's permissions, stop the payment, remove the email, and give Level 2 the sources that show it.

Signs it is real

An AI tool took an action nobody asked for
Instructions hidden in a document or message
An urgent payment request by voice or video with no second check
Key use from a new place or at a new scale

Signs it is harmless

An approved AI tool inside the company's own tenant
Matching change or contract record
Normal volume and users for that tool

Escalate when

Data or money has left
An AI tool is acting with real permissions on attacker text
Credentials or keys are exposed
Many users received the same attack

Common mistakes

Trusting a request because it sounds and looks right
Assuming a polished email is safe
Checking only the AI's output and not the input it read
Treating every AI-tool alert as an attack

Tools you will use

AI tool admin and audit logsCloud billing and API usageMail gatewaySecond-channel call-back

Practice with this playbook

Found something confusing or unrealistic?