The other problem is that AI can be put in charge of phishing operations. Once you devise the correct prompt to get past the filters, it understands what phishing is, and will quite happily write phishing emails for any audience you care to describe. Combine that with an automatic mailer, and you could just fish for IDs (along all the other profitable stuff), and then use those IDs to spam more etc.