Phishing 3.0: what it means for email security teams

TL;DR: Leaked concerns around Anthropic’s Claude Mythos should not distract from the larger problem: today’s AI models already enable personalised, multi-channel phishing at scale, while legacy email gateways still miss 67.5 phishing emails per 100 mailboxes each month, according to IRONSCALES. Static detection is no longer aligned to how attacks are produced or delivered.

Editorial analysis by NHI Mgmt Group, based on content published by IRONSCALES: “Anthropic's Mythos leak is a wake-up call: Phishing 3.0 is already here”.

By the numbers:

• Across 1,921 IRONSCALES customers, the vendor says it catches an average of 67.5 phishing emails per 100 mailboxes per month that bypass existing defenses.

Key questions

Q: How should security teams respond to AI-generated phishing campaigns?

A: Security teams should assume the message quality will be good enough to fool users and focus on reducing what a successful click can do.

Q: Where do legacy secure email gateways fail against AI-driven phishing?

A: They fail when attacks no longer carry stable signatures, repetitive wording, or obviously malicious infrastructure.

Q: What are the signs that multichannel phishing is succeeding?

A: Watch for unusual requests arriving from familiar contacts, sudden changes to payment details, unexpected urgency, and messages that shift between channels to keep pressure high.

Practitioner guidance

• Instrument cross-channel phishing correlation Connect email, chat, voice, and identity telemetry so one campaign can be tracked as a single operation rather than separate events.
• Shift detection toward behaviour and context Tune detections for sender anomaly, thread irregularity, and communication-pattern drift instead of relying on static signatures and repeated payloads.
• Run reconnaissance-based phishing simulations Use test scenarios that reflect how attackers research your organisation, including tone matching, role targeting, and channel switching.

Bottom line: AI-generated phishing is becoming more effective because it can personalise lures, vary content, and operate across multiple channels at once.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →