AI phishing messages fool 28% of targets

AI-generated spear-phishing messages fooled 28% of participants, versus 21% for human-authored messages, and matched or beat humans at producing a click in 80% of comparisons. Brigham Young University’s research summary says participants correctly identified whether a message came from AI only 52% of the time; coworker references made messages 2.3x more likely to be clicked. Builders should stop treating awkward prose as a phishing signal and pair agent access with out-of-band verification for sensitive requests, alongside the archive’s case for AI-era security controls.