A royal scam, and one involving AI

OpenAI’s revelation that a fraud ring is leveraging ChatGPT‑generated “royal decree” emails to dupe donors highlights a new vector for AI‑driven scams targeting public figures and organizations. The article details how the scammers use sophisticated language models to craft convincing, personalized messages that appear to come from legitimate institutions, prompting victims to transfer money or share personal data. For website owners, this development means an uptick in automated, AI‑crafted phishing traffic that can bypass traditional spam filters and appear as genuine outreach. Such bots often crawl site contact forms, comment sections, and newsletter sign‑ups to harvest email addresses and validate the effectiveness of their scams. If your site’s llms.txt file does not explicitly disallow AI crawlers, you may inadvertently provide these malicious actors with the data they need to refine their impersonations. **Actionable tips:** 1. Update your llms.txt to include `User‑Agent: *Disallow: /contact*` and `User‑Agent: *Disallow: /newsletter*` to block AI bots from harvesting submission endpoints. 2. Deploy an AI‑bot detection script (e.g., using request timing, mouse movement analysis, and header anomalies) on all form pages to flag and reject automated submissions. 3. Regularly audit your inbound traffic logs for patterns typical of language‑model bots—such as uniform request intervals and identical user‑agent strings—and add those agents to your llms.txt deny list.