# Large Language Models Can Be Used To Effectively Scale Spear Phishing Campaigns

**Authors:** Julian Hazell  
**arXiv:** [2305.06972](https://arxiv.org/abs/2305.06972)  
**Date:** 2023-05-11  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2305.06972v1/

## Key points

- Recent advancements in artificial intelligence (AI) have resulted in powerful and versatile dual-use systems
- Large language models (LLMs) can be utilized to scale spear phishing campaigns
- LLMs can assist with the reconnaissance and message generation stages of a successful spear phishing attack, improving cybercriminals' efficiency during these stages
- An empirical test was conducted using OpenAI's GPT-3.5 and GPT-4 models to create unique spear phishing messages for over 600 British Members of Parliament
- The messages were not only realistic but also remarkably cost-effective, as each email costs only a fraction of a cent to generate
- Basic prompt engineering can circumvent safeguards installed in LLMs by the reinforcement learning from human feedback fine-tuning process, highlighting the need for more robust governance interventions aimed at mitigating misuse
- Two potential solutions proposed are structured access schemes such as application programming interfaces and LLM-based defensive systems
- The study highlights the astonishing rate of progress seen in generative AI models in recent years through examples comparing GPT-3 and GPT-4's quality difference clearly demonstrating this fact
- Overall, this study demonstrates that large language models can be effectively used to scale spear phishing campaigns and emphasizes the need for robust governance interventions to mitigate their misuse.

## Summary

Recent advancements in artificial intelligence (AI), particularly in large language models (LLMs), have resulted in powerful and versatile dual-use systems. This study investigates how LLMs can be utilized to scale spear phishing campaigns. The report explores LLMs' ability to assist with the reconnaissance and message generation stages of a successful spear phishing attack, where advanced LLMs are capable of significantly improving cybercriminals' efficiency during these stages. An empirical test was conducted by creating unique spear phishing messages for over 600 British Members of Parliament using OpenAI's GPT-3.5 and GPT-4 models. The findings reveal that these messages are not only realistic but also remarkably cost-effective, as each email costs only a fraction of a cent to generate. Moreover, basic prompt engineering can circumvent safeguards installed in LLMs by the reinforcement learning from human feedback fine-tuning process, highlighting the need for more robust governance interventions aimed at mitigating misuse. To address these evolving risks, two potential solutions were proposed: structured access schemes such as application programming interfaces and LLM-based defensive systems. The study also highlights the astonishing rate of progress seen in generative AI models in recent years through examples comparing GPT-3 and GPT-4's quality difference clearly demonstrating this fact. Overall, this study demonstrates that large language models can be effectively used to scale spear phishing campaigns and emphasizes the need for robust governance interventions to mitigate their misuse.