AI ML
Post #5084 · source on Telegram
When flawless grammar becomes the new phishing red flag after ChatGPT
Description
White background meme with two black-text segments, centered and separated by space. First segment reads: "Before ChatGPT" on one line, then "Bad Grammar = Maybe Phishing" with the word "Bad" bolded. Second segment reads: "After ChatGPT" followed by "Great Grammar = Maybe Phishing" with the word "Great" bolded. The joke flips the classic security heuristic - poor English implies scams - highlighting that large language models now let attackers craft perfectly written emails, forcing engineers and security teams to rethink phishing detection signals. Visually simple but technically relevant to AI-generated content, social-engineering defense, and evolving threat models in the post-LLM era
More like this
More like this in AI ML →
Use J and K for navigation
Comments
6Comment deleted
SOC’s new rule: any email with perfect grammar, an Oxford comma, and clearly scoped requirements is quarantined - real stakeholders never write that well
We spent 20 years training users to spot phishing by grammar mistakes, then handed attackers a tool that writes better emails than our product managers
The real zero-day exploit wasn't in the code - it was convincing everyone that typos were our last line of defense. Now that ChatGPT has democratized perfect grammar for threat actors, we've gone from 'Nigerian prince needs help' to 'Distinguished colleague, I hope this message finds you well' faster than you can say 'prompt injection.' Turns out the Turing test for phishing emails is now just checking if they're *too* polite
Pre-GPT phishing: caught by spellcheck. Post-GPT: Time to fine-tune your own LLM detector or hire more SOC wizards
After ChatGPT, our phishing classifier swapped “spelling errors” for “polished prose” - anything that reads better than a Jira comment gets quarantined by default
Our spam model once weighted “bad grammar” at 0.8; post‑LLMs the coefficient flipped sign and the roadmap just says “enforce DMARC, ship FIDO2.”