AI Email Attacks Grew 5x in 2025; AegisAI Launches Vanguard to Neutralize Adversarial AI CAPTCHAs

New research from AegisAI reveals that AI-generated email attacks grew 5X in 2025, with sophisticated threats now bypassing traditional security filters more than 50% of the time. In response to this escalating threat landscape, the company is pre-announcing Project Vanguard, the industry's first proactive defense specifically engineered to defeat adversarial CAPTCHAs. Built by the team behind Google's reCAPTCHA, Project Vanguard applies decades of elite bot-defense experience to neutralize the next generation of AI-driven exploits.

SAN FRANCISCO, March 10, 2026 /PRNewswire/ -- AegisAI, an AI-native email security company backed by Accel and Foundation Capital, today released State of the AI Threat in Email, a new study analyzing over 20,000 phishing, scam and malware emails. The findings are stark: AI-generated phishing attacks have grown 5x in 2025 and are 75% more effective at bypassing traditional email filters.

To respond to this rising threat AegisAI is announcing Vanguard, an autonomous defense AI agent designed to pursue evasive threats that hide behind CAPTCHAs, cloaked pages, and malicious documents, a blind spot for security tools.

The groundbreaking study of AI attacks was presented at the 2026 Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) conference and highlighted the following changes in the threat landscape.

Key Findings

5x growth in 2025. AI-generated spear phishing grew from 2.8% to 13.9% of total observed phishing in 2025.

75% more effective AI-generated emails evade traditional filters at nearly double the rate of human-written attacks, reaching the inbox more than half the time.

72.6% of successful AI attacks passed email authentication. Attackers operate from compromised legitimate accounts with established authentication histories. The better-authenticated the email, the more likely it reaches the inbox.

Vanguard: Extending the Agent from Inbox to Payload

In response to these attacks, AegisAI is launching Vanguard: the first proactive defense that is designed to neutralize adversarial AI CAPTCHAs, cloaked web pages, and weaponized documents. The AegisAI team is leveraging their experience from working on reCAPTCHA at Google to combat this new wave of adversarial evasion.

AegisAI already deploys AI agents inside the inbox to catch attacks that slip past conventional filters. Vanguard extends those agents beyond the inbox. When an inbox agent flags a suspicious link or attachment, Vanguard follows it, navigating the open web just as a user would, to reach the actual malicious destination, whether it's a phishing page, a dangerous document, or a credential-harvesting form. It then delivers a complete threat report in minutes.

The only effective response to AI-powered attacks is an AI-powered defense. While our inbox agents are already catching the sophisticated threats that legacy filters miss, Project Vanguard represents the natural evolution of that protection. By extending our defense beyond the inbox, we are now able to run ahead of the adversary, neutralizing threats before they ever reach the user."
— Cy Khormaee, Co-Founder and CEO, AegisAI

"Security can no longer be a game of catch-up. Our data shows that traditional filters are essentially a coin flip against modern LLM-generated attacks. By leveraging the same architectural DNA we used to build reCAPTCHA, Project Vanguard shifts the battlefield; we aren't just filtering mail, we're proactively neutralizing the adversarial bots behind them. This is an essential step to restoring inbox security in an era of automated deception."
— Ryan Luo, Co-Founder and CTO, AegisAI

Early Access and RSA Conference 2026
Project Vanguard is entering early customer testing later this year. AegisAI will demonstrate Vanguard live during the RSA Conference 2026. Organizations interested in joining the early access program can apply at aegisai.ai/book-demo or attend the demo during the RSA conference. The full Artificial Adversaries research report is available at https://www.aegisai.ai/state-of-the-ai-threat-in-email.

About AegisAI
AegisAI is an AI-native email security company founded in 2025 and headquartered in San Francisco. The company was started by a team of engineers from Google's core security group, including builders of reCAPTCHA (the system that protects billions of web pages from bots and abuse), Safe Browsing (which warns over 5 billion devices about dangerous sites daily), and Web Risk (Google Cloud's enterprise threat detection API). Backed by Accel and Foundation Capital, who led the company's seed round, AegisAI deploys AI agents that defend the inbox against AI-crafted phishing, compromised-account attacks, and evasive payloads that slip past traditional email filters. For more information, visit aegisai.ai.

Media Contact
Patricia Matthews
Head of Marketing, AegisAI
[email protected]
aegisai.ai/

SOURCE Aegis AI Security