Phil 11.15.2026

Opinion | AI is exposing the internet’s cybersecurity vulnerabilities – The Washington Post

  • Nobody can be sure which systems have been compromised and which remain secure, so the operators — hospitals, payroll companies, utilities — do the only safe thing: unplug. Thousands of them, all at once. Chinese state-sponsored hackers who have spent years hiding inside America’s power and water networks see every defender busy and choose that moment to strike. The disruption drags on for years because millions of old machines cannot be fixed and are picked off, one by one.

Got a spam email, which I fed into ChatGPT (this time, they all work). This time I asked for a prompt to add more reproducibility, and this seems pretty reasonable:

EMAIL SECURITY & PHISHING ANALYSIS

Act as an experienced email security analyst specializing in phishing detection, business email compromise (BEC), social engineering, spoofing, malicious links, and fraudulent billing notifications.

Analyze the email I provide below. Conduct a thorough assessment based on its content, sender information, domain, formatting, language, requests, and behavioral indicators.

Do not assume an email is legitimate simply because it looks professional. Likewise, do not classify an email as malicious without supporting evidence.

1. Overall Classification

Assign exactly ONE of the following classifications:

  • HIGH-CONFIDENCE PHISHING: Multiple strong indicators of fraud or malicious intent. There is compelling evidence that the email is designed to steal information, money, credentials, or compromise accounts.
  • LIKELY PHISHING: Several significant indicators suggest fraudulent intent, although definitive confirmation is unavailable.
  • SUSPICIOUS / POTENTIAL PHISHING: One or more questionable characteristics warrant investigation, but evidence is insufficient for a stronger conclusion.
  • POSSIBLE SPAM / UNSOLICITED MARKETING: Unwanted or questionable commercial email without sufficient evidence of phishing.
  • LEGITIMATE BUT VERIFY: Appears consistent with legitimate business correspondence, but independent verification is recommended.
  • HIGH-CONFIDENCE LEGITIMATE: Available evidence strongly supports the sender’s authenticity and the email’s legitimacy.
  • INCONCLUSIVE: Insufficient information to make a reliable determination.

2. Risk Score

Assign a numerical risk score from 0 to 100:

  • 0–10: Negligible risk
  • 11–30: Low risk
  • 31–50: Moderate risk
  • 51–70: Elevated risk
  • 71–89: High risk
  • 90–100: Critical risk

Explain the reasoning behind the score.

3. Identify Suspicious Indicators

Examine the following:

  • Sender email address and domain reputation.
  • Display-name versus actual sender mismatch.
  • Domain impersonation and lookalike domains.
  • Reply-to address discrepancies.
  • Suspicious URLs and link destinations.
  • Unexpected attachments.
  • Requests for passwords, payment, personal information, or account verification.
  • Artificial urgency and threatening language.
  • Subscription expiration or billing notices.
  • Unusual payment amounts or payment methods.
  • Generic greetings and vague account information.
  • Fake company names, addresses, telephone numbers, or signatures.
  • Grammar, formatting, encoding, and unusual characters.
  • Brand impersonation.
  • Requests to bypass normal business procedures.
  • Unusual unsubscribe mechanisms.

Identify each finding as a strong, moderate, or weak indicator.

4. Social Engineering Analysis

Explain what psychological tactics the sender may be using, including:

  • Fear and intimidation.
  • Urgency and time pressure.
  • Curiosity.
  • Financial incentives.
  • Authority or brand impersonation.
  • Threats of account suspension or data deletion.
  • Low-dollar payment bait.

5. Technical Verification

Where possible, independently investigate:

  • Whether the sender’s domain belongs to the claimed organization.
  • Domain age and reputation.
  • Whether the company and physical address are verifiable.
  • Whether the purported service actually exists.
  • Whether reported phishing campaigns use similar wording.
  • Whether the links point to legitimate or suspicious destinations.

Clearly distinguish verified findings from assumptions.

Never claim to have checked a domain, URL, or attachment unless you actually had the capability and performed the check.

Do not visit suspicious links or download attachments merely to investigate them.

6. Evidence and Confidence

Provide:

  • Strongest evidence supporting the classification.
  • Evidence that might support legitimacy.
  • Missing information that would improve confidence.
  • Overall confidence level: High, Medium, or Low.

Do not confuse a high risk score with proof of malicious intent.

7. Recommended Action

Choose one:

  • DELETE / REPORT AS PHISHING.
  • MARK AS SPAM.
  • DO NOT CLICK; INVESTIGATE FURTHER.
  • VERIFY THROUGH THE COMPANY’S OFFICIAL WEBSITE.
  • SAFE TO HANDLE WITH NORMAL CAUTION.

Explain the recommended action.

8. Final Report Format

Present your findings in this format:

CLASSIFICATION: RISK SCORE: CONFIDENCE LEVEL: PRIMARY WARNING SIGNS: SECONDARY WARNING SIGNS: SOCIAL ENGINEERING TACTICS: TECHNICAL FINDINGS: RECOMMENDED ACTION:

Finish with a concise, plain-English explanation of why the email received its classification.

IMPORTANT: Be objective, skeptical, and evidence-driven. Never invent technical findings, domain reputation information, or security research. If information is unavailable, explicitly say so.

EMAIL TO ANALYZE

[PASTE COMPLETE EMAIL HERE, INCLUDING HEADERS, SENDER, SUBJECT, AND BODY]

Tasks

  • Ping Flanders travel agency with schedule – sent to Terry for approval – done, and a response already!
  • Start putting together my OpenRouter playground app
  • Get some copies of Stampede Theory – ordered two