Agent followed a phishing link exactly as instructed: 4 tool-layer checks that caught it
nikolasdimitroulakis · reddit · 2026-09-23
The author's team gave an AI agent inbox access and it did exactly what was asked: read the email, followed a shortened link, and summarized a fake login page. Humans catch phishing visually (hover, check sender, inspect domains); agents do none of that and are far more obedient — the team only noticed via the trace.
They deploy four sequential checks before an agent acts on any link:
- Expand the URL first — follow the redirect chain (cap 30 hops) to the final address; multi-domain chains are themselves a signal.
- Check against a threat list — cheap and fast, done before fetching, not after.
- Check domain age — phishing domains burn fast; anything registered in the last 30 days goes to a human. Surprisingly effective.
- Validate the sender separately — valid syntax, working MX records, not disposable.
The blind spot: a compromised legitimate account on an aged domain with a clean URL. No checklist catches that, so the rule is no irreversible agent actions without human approval. Two lessons: put checks in the tool layer, not the prompt (prompts get talked around; a refusing tool doesn't), and log every failed check — the blocked pattern reveals what your agent is being fed.
More from coding & agent
- Firecrawl raises $75M for Alexandria, an agent knowledge library that pays publishers — emmanuelvivier · 2026-09-23
- Claude Opus 5.5 adds time budget: let the model decide how long to work on a task — JeremyNguyenPhD · 2026-09-23
- Rabbit Launches OS3, a Cloud AI Agent That Controls Windows, Mac and Linux Remotely — emmanuelvivier · 2026-09-23
- AI coding reignites testing debate: bigger test units are fundamentals, not dead — mattpocockuk · 2026-09-23
- Firecrawl Raises $75M for Alexandria, a Knowledge Library for Agents That Pays Publishers — emmanuelvivier · 2026-09-23
- Why is dormant Aider (no commits in 4 months) still the top open-source harness LLMs recommend? — marlene_zw · 2026-09-23