Security Vendors Are Building Anti-Phishing Tools Directly Into ChatGPT and Claude

A wave of new integrations is bringing real-time phishing and scam detection directly into the AI chat interfaces millions of people already use daily, letting users vet a suspicious link, email, or message without ever leaving ChatGPT or Claude.

Malwarebytes announced a new, free connector for Anthropic's AI assistant that brings its scam detection capabilities and threat intelligence directly into Claude conversations, helping users quickly identify phishing attempts, scam calls, suspicious social media messages and malicious links without leaving their chat. The tool can check suspicious links, domains and phone numbers, verify domain legitimacy via WHOIS lookups, and analyze multiple threats simultaneously from a single message, such as an image and text together, returning a clear verdict of Malicious, Suspicious, Safe, or Unknown for each query.

Norton has taken a similar path. As of June 30, the Norton Genie scam detector became available as a native connector inside Claude, across all subscription tiers, letting users paste in a dodgy message, link, email, or screenshot and get an analysis that draws on Norton's actual security infrastructure  including URL reputation databases, redirect tracing, domain history, and phishing pattern recognition  rather than just a language model's best guess. Norton had already rolled out the same connector for ChatGPT earlier in the year, and the integration comes as Norton reports that nine in 10 threats targeting consumers in 2025 originated from scams, phishing and fake advertisements. 

The timing and rationale behind these launches point to a clear industry shift. AI chat assistants have quietly become a first stop for people trying to figure out whether something is a scam  as one Norton executive put it, "people are already asking AI tools whether something feels legitimate, suspicious, or safe to engage with." The problem is that general-purpose AI models are good at reasoning through suspicious-looking language, but they don't inherently have the underlying threat databases, URL reputation history, or WHOIS/domain registration signals needed to make that judgment reliably. These connectors are effectively an admission  from AI labs and security vendors alike — that AI-based textual reasoning about a link needs to be grounded in real security infrastructure, not just plausible-sounding inference.

This matters more now because the barrier to running a phishing campaign has fallen sharply. Generative AI tools make it trivial for attackers to produce fluent, well-formatted phishing emails, cloned login pages, and convincing impersonation content at scale removing the grammatical and stylistic tells that used to help people spot scams. Security vendors are responding by meeting users exactly where this new class of AI-generated threats is likely to be encountered: inside the same AI assistants people already trust for everyday tasks.

There's also a competitive dynamic worth watching. Multiple vendors (Malwarebytes, Norton, and likely others) racing to become "the" trusted security layer inside ChatGPT and Claude suggests this is shaping up as a new distribution battleground similar to how antivirus vendors once competed for pre-installed placement on new PCs. Whoever becomes the default or most-used connector inside these assistants gains a significant advantage in reach and brand trust.

The tradeoff is that this approach depends on adoption  these tools work only when a user proactively enables the connector and thinks to ask before clicking. Given that many phishing victims don't pause to question a link at all, the deeper industry challenge remains less about technology and more about getting real-time protection engaged automatically, rather than on request.