15Cyber & softwareBelow the top 20
Population-scale spearphish
CapabilityDomain knowledgeAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that models can write a personalised lure from a public profile in seconds, there is a possibility of millions of distinct, high-quality phishing messages in a day resulting in credential harvest that no longer looks like a campaign.
Likelihood
4Likely
Consequence
3Major
Urgency
3Priority
Spam filters were built for copies. These are not copies.
Composite 15 = 4×3 + 3
Applicable mitigations
Controls · Retire voiceprint as an authenticator · Real-time clone detection on high-risk lines · Out-of-band confirmation on a known number · Hardened weight storage and insider controls · Mandatory vulnerability-sharing with national CERTs before launch · Staged release with external red-team gates