Your Help Desk Just Reset a Password for an AI Agent
Mohammad Eshan, founder and CEO of GhostEye, spoke at SecureWorld Boston 2026, held April 8–9 at the Hynes Convention Center.
His session, “Your Help Desk Just Reset a Password for an AI Agent,” took place on April 8, from 11:10 to 11:45 a.m. in room 208. It examined how AI voice agents could impersonate employees when calling an external help desk.
Testing identity checks over the phone
The research combined publicly available employee information, tailored pretexts, and AI voice agents in calls to live external help desks. The question was whether a caller could persuade an agent to provide access or information by sounding like someone entitled to it.
Eshan covered the approach, where it worked, where it failed, and how organizations could strengthen their verification procedures. The session connected social engineering to a specific security decision: what evidence a help desk accepts before changing someone’s access.
For a closer look at account recovery, read MFA Resets: Who Did the Help Desk Let In?.
