# ChatGPT's Writing Style Feature Solves the One Problem That Made AI Phishing Detectable
OpenAI is testing a feature that lets ChatGPT ingest samples from your connected apps — Google Docs, email, notes — and learn to write exactly like you. The pitch is personalization. The problem is what happens when that capability gets aimed at someone else.
## What the Feature Actually Does
The "Writing Style" feature, currently appearing for select ChatGPT users, pulls writing samples from connected third-party apps through OAuth integrations and builds a style profile. From there, ChatGPT generates content — emails, messages, documents — that mirrors your voice, sentence rhythm, vocabulary choices, and even your idiosyncratic punctuation habits.
OpenAI's framing is productivity: stop sounding robotic, get an AI that actually sounds like you. That's a real use case. Plenty of people hate that their AI-drafted emails read like a press release from a company that doesn't exist.
But the feature requires something significant: persistent read access to your personal documents and communications. To learn your style, it has to read your corpus. That's the part that deserves more scrutiny than it's getting.
## The Impersonation Attack Surface Nobody's Talking About
Here's the security story that's being largely missed in the initial coverage: AI-generated phishing and Business Email Compromise (BEC) messages are currently detectable — not easily, but detectable — partly because they don't sound like the person they're impersonating. A fraudulent email from your CFO still doesn't quite nail the cadence, the sign-off, the way she actually constructs requests. That mismatch is a signal.
OpenAI just built a tool that eliminates that signal.
A feature that trains on your actual writing and reproduces it convincingly is, architecturally, the same thing as a feature that could train on *someone else's* writing if an attacker got access to their corpus. The defensive value of "this doesn't sound like her" collapses once writing-style training becomes widespread and accessible.
That's not a theoretical threat. BEC fraud cost businesses $2.9 billion in 2023 according to the FBI's IC3 report — and that's losses that were actually reported. The attacks work because they exploit trust, timing, and authority. The thing standing between a good BEC attack and a great one is often a slight mismatch in voice. Remove that gap and you've removed one of the last human-detectable signals.
## OAuth Creep and the Blast Radius Problem
The second issue is access scope. To use Writing Style, you're granting ChatGPT OAuth read access to the apps you connect. In practice, for most users that means Google Workspace — Docs, Gmail, Drive. Maybe Notion. Maybe Outlook.
OAuth tokens don't expire just because you forgot you granted them. They accumulate. And when a major platform gets breached — or when a user's OpenAI account gets compromised — the token can be used to read everything the integration was authorized to touch.
This isn't hypothetical. In 2023, a breach of CircleCIs's systems exposed OAuth tokens that customers had used to connect services. The blast radius wasn't CircleCI's data — it was everything downstream of those tokens. The same architecture applies here. A compromised OpenAI account isn't just a ChatGPT account anymore; it's a reader credential for your documents and email.
For individuals, that's concerning. For enterprises, it's a policy crisis waiting to happen.
## The Corporate Account Problem
Employees will do what employees always do with convenient productivity tools: they'll connect their work accounts. Not because they're careless but because nobody told them not to, and the feature is genuinely useful. Their writing style training corpus will include internal project documentation, strategy memos, client correspondence.
Security teams that haven't yet issued guidance on which apps can be OAuth-connected to AI tools are already behind. The window for getting ahead of this is closing fast.
The CASB and DLP controls that many enterprises rely on weren't built with "AI style training via OAuth" as a threat model. They're looking for bulk data exfiltration, not persistent low-volume reads that look like a user browsing their own files.
## What Defenders Should Do Right Now
This doesn't require panic — it requires policy.
For security teams:
For individuals:
---
## HackWire Analysis
The privacy coverage around this feature has largely focused on OpenAI's data retention policies, which matters but misses the sharper edge of the story.
The real shift here is behavioral: writing style AI tools normalize giving language models persistent access to personal and professional documents. Once that access is normalized, the conversation about what else those integrations might do — or what happens when they're compromised — becomes much harder to have.
There's a pattern worth noting. Every major wave of AI personalization features has followed the same arc: launch with a compelling productivity pitch, collect data necessary to deliver it, and address the security and privacy implications later, usually after an incident forces the issue. We saw it with contact-syncing features in social apps, with location history in mapping services, and with voice recording in smart speakers. The feature is real, the benefit is real, and the downstream security consequences arrive on a delay.
What makes this one different is the intersection with social engineering. BEC and spear phishing are already the most financially damaging category of cybercrime. Adding a readily accessible tool that can close the last detectable gap in impersonation — the voice mismatch — isn't just a privacy story. It's an attack capability story.
Security awareness training will need to adapt. The heuristic of "does this sound like them?" is becoming unreliable. Organizations need to build out-of-band verification for high-stakes requests into process, not just training. That's not a new idea — it's just becoming urgent.
— HackWire Editorial
---
## Related Coverage