AegisAI Launches Proteus to Combat AI-Generated Phishing Attacks

NEW YORK, Oct. 8, 2026 /CourierPR/ -- AegisAI, the first AI lab for email security, has launched Proteus, a foundational model designed to investigate every incoming email as thoroughly as a security analyst would. This new tool aims to address the growing threat of AI-generated phishing attacks, which are becoming more sophisticated and harder to detect.

Proteus stands out in its ability to catch more than 99% of 3,020 real phishing attacks, significantly outperforming leading general-purpose AI models. According to AegisAI, Proteus identified 81% and 80% of the same attacks, respectively, for a leading closed-source general-purpose model and a widely used open-weight model. The new model also returns verdicts up to 7.2 times faster than the leading closed-source model.

The launch of Proteus comes at a time when generative AI is making tailored, convincing phishing attacks cheaper and easier to produce at scale. Cy Khormaee, the CEO of AegisAI, noted that AI-generated spear phishing rose from under 1% in 2025 to more than a fifth of the attacks the company tracked. By 2028, these AI-generated attacks are expected to make up the majority of phishing attempts.

Unlike traditional email security methods that rely on historical attack signatures, Proteus operates as an autonomous security analyst. It verifies the authenticity and contextual integrity of every incoming message by checking who sent it, where its links lead, and what it's really asking for. This approach ensures that Proteus can catch novel attacks that have never been seen before.

AegisAI's team first saw the need for Proteus while at Google, where the variety of attacks each day was outgrowing what detection rules and behavioral models could cover. The company moved from prompting frontier models to fine-tuning and then training open-weight models, each approach improving results but none specialized enough to counter AI-generated attacks. This led the lab to build its own model from scratch.

Proteus processes each email as a structured object, combining the message content, headers, sender and recipient history, sanitized link and attachment data, and threat intelligence. According to AegisAI, this method cuts token costs and improves accuracy. The model also excels in catching attacks designed to look legitimate, such as credential theft and business email compromise. For reconnaissance emails, which have no links or attachments and just try to get a reply, Proteus still catches them by verifying the sender's claims.

The evaluation of Proteus used 3,020 human-verified phishing attacks from a single week of AegisAI's production traffic, none of which appeared in Proteus's training data. At the median, Proteus was 7.2 times faster than the leading closed-source model and 26 times faster on the slowest 5% of verdicts. An ablation test showed that the same model supplied with evidence at inference identified 8.4% more phishing than without it. AegisAI also calibrates Proteus by examining internal activations against ground-truth outcomes, placing 82% of scored messages in a usable confidence band with an expected calibration error of 0.037 before any post-hoc fitting.

AegisAI flagged the first message in a recent customer incident 89 minutes before the account-takeover alert went off. The attackers used a malicious OAuth grant to take over a Google Workspace account and sent bid invitations to the customer's suppliers. Because the messages really did come from the compromised account, they passed SPF, DKIM, and DMARC checks. This incident highlights the limitations of traditional email security methods, which rely on rules, signatures, and anomaly detection that can be easily bypassed by AI-generated attacks.

In conclusion, Proteus represents a significant step forward in email security, offering a more robust and faster detection system against AI-generated attacks. As the threat landscape continues to evolve, Proteus is poised to play a crucial role in protecting enterprises from sophisticated phishing attempts.