Generative AI has changed what a phishing email costs to produce: grammatically clean, organisation-specific lures at a scale that used to require a skilled human writer. The defensive side of that story - whether machine-learning classifiers can keep up - has a substantial published research literature behind it. This article is a summary of that published research, not a report on a model trained for this site.
//High Benchmark Accuracy, a Known Generalisation Problem
A recurring theme across recent surveys is a gap between benchmark accuracy and real-world performance. One review of phishing-website detection work reports Random Forest models reaching accuracy near 99 percent in controlled evaluation, with other classifiers (Support Vector Machine, Decision Tree, Logistic Regression) close behind - but the same review frames its central question as what that accuracy figure actually holds up to in practice, and which factors degrade it outside the benchmark.
A 2022 IEEE Access review covering 81 papers reaches a blunter conclusion: despite decades of development, existing phishing detection techniques still fall short on accuracy and on detecting attacks the model has not seen a version of before. High accuracy on a held-out test set drawn from the same distribution as the training data does not necessarily predict how a classifier handles a genuinely new phishing campaign.
Where the gap comes from
A 2024 survey points to a specific, fixable-sounding cause: heavy reliance on URL-based features. Models trained mostly to recognise suspicious URL patterns can be strong against the kind of phishing that relies on an odd-looking link, and weaker against campaigns - AI-generated or otherwise - that use a clean, freshly registered domain and put their effort into the message text instead. The survey argues this dependence partly explains why successful phishing attacks remain common despite consistently high reported accuracy figures in the literature.
A PRISMA-based systematic review of 33 deep-learning studies on phishing email detection reaches a similar conclusion from a different angle: it identifies the adaptability of detection models to new phishing behaviours as the field's major open improvement area, rather than raw classification accuracy on known patterns.
//What Survey Authors Recommend
A comparative analysis of detection techniques concludes that machine learning is a promising path to accurate, scalable detection, while naming three concrete costs: dependence on the training data, computational cost, and the need for continuous retraining as attackers adapt - none of which are one-time problems a single well-trained model solves. A 2025 review comparing behaviour-based, heuristic, machine-learning and signature-based methods lands on a hybrid approach, combining several of these techniques, as offering stronger defence than any one method alone.
//Where AI-Generated Phishing Specifically Fits
None of the surveys found for this rewrite isolate AI-generated lures as a distinct evaluation category with its own accuracy figures. The generalisation problem described above - models that do well on known patterns and worse on genuinely novel ones - is the closest documented analogue: an LLM-written lure that avoids the stylistic and grammatical tells older phishing emails had is, in effect, a harder-to-classify novel case, for the same underlying reasons the surveys describe.