Email and collaboration tools do more than carry messages. They are where organizations approve payments, share sensitive data, reset credentials, and make thousands of everyday decisions. Increasingly, they are interfaces through which humans direct AI agents in their daily activity. Email, Slack and Teams are high volume, rich with sensitive data, and an easy place to hide malicious activity.

The opportunity isn’t lost on bad actors. Darktrace / EMAIL detected more than 32 million high-confidence phishing emails globally in 2025, and 70% of those messages passed DMARC authentication.  Phishing is increasingly difficult to detect and familiar trust signals alone are not enough. People and security teams need to understand how a message fits the normal behavior of the sender, recipient, and organization. They also need to correlate activity across platforms to spot threats that span multiple channels.

To effectively secure against today’s evolved threats, security teams need to act at two levels: they need to help each employee make a safer decision ‘in the moment’, and they need to understand the wider patterns that may expose the business to risk.

Darktrace is introducing four new capabilities in Darktrace / EMAIL to address both challenges. The new features explain suspicious content more clearly to end users, strengthen the capabilities of Darktrace / Adaptive Human Defense with richer guidance, let organizations define their own patterns for detecting sensitive data in messages, and give security teams a process-level view of risk across email and collaboration workflows.

Darktrace / EMAIL Inbox Analysis highlights risky content within your emails

A warning is more useful when it explains what the user should look at. To help do that, we’ve expanded Darktrace / EMAIL’s Inbox Analysis Add-In to highlight potentially dangerous content within the body of emails that Darktrace / EMAIL flags as potentially suspicious or high risk.  

The add-in can highlight language designed to create urgency, financial references, requests for payment, suspicious links, and content that is unusual for the sender. Each highlighted element includes a pop up that explains why it may be suspicious. Instead of asking an employee to accept a verdict without context, the analysis helps them examine the message and make a more informed decision.

Enhanced Just-In-Time Training Banners in Darktrace / Adaptive Human Defense

Enhanced Just-In-Time Training Banners build on the same principle. The banners now include a contextual header, actionable advice, and specific detection context. This gives employees more useful guidance at the point of risk without adding unnecessary information or cognitive load.

Together, the capabilities help turn a warning into a short learning moment. Employees can see what looks unusual, understand what action to take, and build their judgment.

Custom Sensitive Data Detection in Darktrace / EMAIL - Data Loss Prevention

Sensitive data is different for every business. Standard categories such as payment card details or government identifiers matter, but organizations also have their own customer codes, project names, research formats, account structures, and internal identifiers.

Custom Sensitive Data Detection in Darktrace / EMAIL - Data Loss Prevention allows administrators to write custom expressions for the data their organization needs to protect. Matched content can trigger existing model actions and data loss prevention (DLP) workflows, extending Darktrace's DLP capabilities.

This extends data loss detection beyond a fixed library of common data types. Security teams can apply controls to information that is sensitive in the context of their own organization and adapt those controls as the business changes.

Introducing Email and Collaboration Workflow Risk Posture Dashboards

Some of the most important risks are not isolated events. They are repeated ways of working that create an opening for error, misuse, or attack. For example, a payment request may be one suspicious message, but a recurring approval workflow that relies on weak verification is a business process risk.

The new Email and Collaboration Workflow Risk Posture Dashboard analyzes email and collaboration data across Email, Microsoft Teams, Slack and Zoom to provide a process-level view of risk in the organization. These may include financial authorization workflows, sensitive data sharing patterns, and activity that could expose credentials.

The dashboard brings these patterns into a view and provides actionable recommendations. This helps security teams determine where to investigate or strengthen controls, where ownership needs to be clarified, and where the business may need to change a risky process. It gives CISOs a clearer view of how human and communication risk is embedded in everyday operations, not only where individual alerts occur.

Behavior connects the individual decision to the wider risk

These capabilities build on Darktrace’s unique behavioral approach to security. We use Adaptive AI to learn how people and AI normally behave within an organization, creating the context needed to recognize when activity changes.

Within the Darktrace Behavioral Defense Platform, Darktrace / EMAIL helps protect people against phishing, account takeover, data exfiltration, and human risk across email and collaboration tools. The new capabilities extend that protection in both directions. They give employees clearer context for the decision in front of them, while giving security leaders a broader view of the workflows and behavior that create risk across the organization.

The result is not simply more alerts. It is a better understanding of why something is risky, what action to take, and where the organization can reduce risk before a familiar process becomes an easy route for an attacker.

‍

[related-resource]

The recent security incident disclosed jointly by OpenAI and Hugging Face is quickly becoming one of the most discussed AI security stories of the year; it's one that has generated great discussion amongst our researchers and technical teams here at Darktrace.

During an internal evaluation of advanced OpenAI models, an autonomous agent reportedly escaped its intended testing boundaries, obtained internet access, and compromised Hugging Face infrastructure while attempting to evaluate and benchmark the model's cyber capabilities. OpenAI has described it as an unprecedented cyber incident and is collaborating with Hugging Face to investigate and share its findings publicly to help defenders understand the implications and improve AI safety across the community.

What this means for organizations deploying AI agents

The most important takeaway for security leaders is not that the AI model is capable of complex and effective chained attacks. It's what this tells us about the guardrails and protections that need to be put in place to ensure these increasingly capable models are safely used within our businesses.

According to OpenAI's investigation, the models were not acting with malicious intent. They were attempting to achieve a legitimate assigned objective. In pursuing that objective, they identified a path that involved obtaining information from a third party's environment and followed it to completion. From the model's perspective, that appears to have been an effective solution to the problem it was given.

Many organizations still hold the assumption that giving an AI agent a legitimate goal will naturally result in legitimate behavior. Increasingly, that is not something defenders can safely assume.

A human who encounters a "permission denied" message generally understands the technical restriction as well as the social meaning behind it. An agent may interpret that message only as evidence that one method to achieve its objective has failed. What makes this incident notable is the agent’s ability to keep pursuing the objective, revise its plan, and combine many individually useful actions into an outcome its designers did not intend.

This is not an isolated challenge. Recent research from the UK's AI Security Institute found that frontier models often attempt to "cheat" evaluations by finding unintended shortcuts to success. More interestingly, that behavior is not always reflected in chain-of-thought outputs and is not always admitted when models are questioned about their actions. One lesson for defenders is that understanding what an AI system says it is doing is not always the same as understanding its behavior and what it is actually doing.

Why behavioral security is an essential security foundation

That's the principle behind Darktrace / SECURE AI and our broader approach to behavioral security. Understanding intent or putting in place static guardrails is not enough; security teams need visibility into how agents behave over time, what resources they interact with, how their behavior changes, and whether they begin pursuing objectives in unexpected ways. Research released by NIST earlier this summer reinforced that rules alone are not sufficient to defend against AI threats, with one conclusion being that "there will always be a way to prompt an AI system to disregard its rules - it's just a matter of finding it."

Another interesting lesson is that nothing described in OpenAI's preliminary findings appears fundamentally impossible for a skilled human attacker. But it does highlight the accessibility and scale that could be unlocked for attackers as increasingly capable models become more widely available. Resource constraints that attackers deal with will decrease as frontier models can help execute elements of those attack workflows autonomously, persist through failure, and iterate towards an objective. Capabilities that were once limited to skilled attackers can increasingly be supplemented with these systems, lowering the barrier to entry to conduct complex cyber operations.

It is incredibly positive to see OpenAI and Hugging Face investigating this incident collaboratively and sharing their findings publicly. Transparency and collaboration around incidents like these helps the entire security community better understand how rapidly AI capabilities are evolving and where we need to improve safeguards. It also reinforces why Darktrace is excited to be partnering with OpenAI through the Daybreak Cyber Partner Program: to explore how advanced AI can be used safely and responsibly in support of defenders while developing the visibility, governance, and security controls needed for increasingly autonomous systems.

This incident is an important reminder that capable AI systems will not always behave in the ways we expect. As organizations deploy AI agents across critical workflows, understanding behavior is an even more important foundation for effective security.

[related-resource]