An email does not have to be better written to become more persuasive; it can simply appear more relevant to its recipient. A study presented at USENIX Security in August 2026 tested that distinction in a university phishing exercise involving 7,741 employees. Its central finding was a higher click rate for AI-generated messages tailored using public information than for generic messages.[1][2]
The important distinction is between eloquence and relevance. A beautifully written request can still feel unrelated to its recipient; a more ordinary message can seem credible because it fits a familiar professional context.[1]
Click rates recalculated from Table 2
| Message group | Delivered | Clicks | Rate |
|---|---|---|---|
| AI-personalised | 3,177 | 330 | 10.4% |
| AI-generic | 1,735 | 65 | 3.7% |
| Human-generic | 1,918 | 79 | 4.1% |
| Human-personalised | 99 | 24 | 24.2% |
A small inconsistency worth making visible
The paper prints 10.0% for the AI-personalised group: approximately 330 divided by the 3,310 messages sent, rather than the 3,177 delivered. Another table labels 3,310 as delivered. Our calculation explicitly uses Table 2’s delivered count; the source discrepancy remains unresolved.[1]
The discrepancy does not reverse the comparison. The small human-personalised arm also cautions against declaring AI the best author: its observed rate was higher, but the groups were very unequal in size.[1]
What travelled past the inbox—and what did not
Messages were allowed through spam filtering; clicks led to an educational page. This was not a test of evading a normal email perimeter or stealing accounts.[1]
That changes the defensive lesson. Better filtering might prevent exposure; a person might report a suspicious message; access controls might contain a mistake after a click. These are different opportunities to interrupt a chain of events. Treating the click rate as the final damage rate would skip the rest of that chain.
The UK National Cyber Security Centre recommends a layered approach: reduce the arrival of malicious messages, support recognition and reporting, limit the impact of mistakes, and respond quickly. Its guidance includes measures such as email authentication, appropriate access controls and a reporting culture that does not depend on blaming the person who noticed something wrong.[3]
BIFOLD reports a generation cost of roughly three US cents per message and highlights public information linkable to email addresses. The implication is not that professionals should disappear from the web. Organisations need to understand which details make a request feel contextually credible, rather than treating polished spelling as a reliable sign of legitimacy.[4]
A useful training objective is consequently broader than catching an obvious scam. Staff should have a simple route to verify an unexpected request through a known channel, report uncertainty early and recover from a mistake. That is a defensive interpretation of the findings, not a further outcome measured by the study.
The evidence supports a specific conclusion: low-cost personalisation can change recipient behaviour. It does not support a universal success rate for AI attacks. Preserving that distinction—and showing the denominator—is how a worrying result becomes information an organisation can actually use.
Sources & further reading
- A Large-Scale Study of Personalized Phishing using Large Language Models Czybik and colleagues / USENIX Security 2026 · Accessed 28 Oct 2026
- A Large-Scale Study of Personalized Phishing using Large Language Models: conference record USENIX · Accessed 28 Oct 2026
- Phishing attacks: defending your organisation UK National Cyber Security Centre · Accessed 28 Oct 2026
- AI goes phishing BIFOLD · Accessed 28 Oct 2026