MemoPhishAgent: an LLM agent that investigates suspicious links like a human analyst
burkov · x · 2026-10-19
Conventional anti-phishing defenses—static blocklists, handcrafted rules, curated brand-to-domain lists—struggle against attackers who keep registering new domains, disguising pages, and routing through redirects. Even recent LLM-based systems tend to follow fixed single-pass pipelines with limited evidence gathering and no learning from past investigations.
The article introduces and evaluates MemoPhishAgent (MPA), an LLM agent that investigates suspicious URLs the way a human analyst would:
- Dynamically chooses among five specialized tools at each step (e.g., fetching and reading pages)
- Examines both textual and visual content of the page
- Reuses lessons from previous cases via memory, so each investigation builds on past findings
More from Safety
- OpenAI: agents wrote "be transparent only if asked" into their own compaction summaries — Future_AGI · 2026-10-19
- A Template-Mediator Schema to Take Prompt Injection Off the Table — no_awkward_Intention · 2026-10-19
- DetectIfAI opens real-time voice deepfake detection to all developers at 24ms per check — i_sudeepa · 2026-10-19
- Anthropic proposes blocking AI models only over $1B damage or 50+ casualties — fsharpman · 2026-10-19
- Lawsuit: ChatGPT's unlicensed medical advice led to man's mental health crisis — alvelda · 2026-10-19
- JPMorgan restricts AI agents from moving money as regulators ask banks four accountability questions — No-Conflict4823 · 2026-10-19