Each level of LLM personalization raises phishing click intent odds by 28%.

arXiv 2609.04410 recruited 180 US working adults to rate AI-generated phishing emails built at four cumulative personalization levels: workplace only, then name and job title, then responsibilities, then coworker and shared-project context. Across 1,436 evaluations convincingness rose 2.40 points per level and click-intent odds rose 28% per level. The finding I hadn't seen before: among non-clickers, reporting went down while deletion went up. Better phishing doesn't just catch more people, it degrades the reporting signal your security team relies on to know it's happening.