A phishing email with all-true facts and passing SPF — and how Grok still caught it
pwlot · x · 2026-10-13
The author shares a near-perfect phishing email analyzed by Grok. Disguised as an X "new sign-in" security notice, every verifiable fact in it was real: the ASEAN-Korea HPC Facility at BRIN (Indonesia) exists with matching hardware (64× NVIDIA H200s, FuriosaAI RNGD NPUs, AMD EPYC Turin, 4.28 PFLOPS, InfiniBand), the domain passed SPF/DKIM/DMARC, and both the named person and the spoofed sender are real faculty members.
Grok still flagged it as phishing/spam based on classic tells like subject-vs-body mismatch. The takeaway: verifiable facts and even email authentication offer no protection against credential-harvesting lures.
More from Safety
- Adversarial AI raised specialists' harmful decision rate from 2% to 49% despite human oversight — EricTopol · 2026-10-13
- Cryptographer Matthew Green: picking an OpenRouter provider is like buying insulin off Facebook Marketplace — matthew_d_green · 2026-10-13
- Agents must be lawful by design: safety should live in the inference engine — rseroter · 2026-10-13
- OpenAI Fires Three Safety Researchers Who Wrote Chain-of-Thought Monitorability Paper — Don't Worry About the Vase (Zvi) · 2026-10-13
- UK Home Secretary invokes Bentham's Panopticon in vision for AI surveillance — nitarshan · 2026-10-13
- 210-page paper argues a durable pause on frontier AI training is feasible — KatjaGrace · 2026-10-13