ChatGPT's Scary Good at Getting People to Click Phishing Emails, IBM Finds

Don't open that link!

Click Bot

OpenAI's ChatGPT can spit out a poem or write a letter if you're at a loss for words. Or, given the right prompts, you can use it to write a convincing phishing email at unprecedented speed and scale.

Case in point, IBM researchers posted an internal study that details how they unleashed a ChatGPT-generated phishing email on a real healthcare company to see if it could fool people as effectively as a human-penned one. The human email won with a slightly higher click rate of 14 percent — but just barely, compared to ChatGPT's click rate of 11 percent. And crafting a carefully targeted phishing email took a human team around 16 hours, they wrote, while ChatGPT took just minutes — findings that ought to scare anybody with an email address.

"Humans may have narrowly won this match, but AI is constantly improving," said IBM hacker Stephanie Carruthers wrote of the work. "As technology advances, we can only expect AI to become more sophisticated and potentially even outperform humans one day."

Message Medium

Given these results and AI chatbots rapidly improving, what can individuals do against this inbox onslaught?

IBM's suggestions ranged from common sense, like calling the purported sender if something looks suspicious, to anemic, like looking out for "longer emails," which they said are "often a hallmark of AI-generated text."

The bottom line, though, is just to use your common sense — and to prepare yourself for an internet that looks set to be rapidly overrun with AI-generated content, malicious or otherwise.

More on AI chatbots: Researchers Just Found Something Terrifying About Talking to AI Chatbots