Russia's largest bank is betting on multimodal AI agents to combat phishing. The new system, presented at the Offzone 2026 conference, promises to automate the hunt for fraudulent websites that appear by the thousands every day.
The phishing problem has reached a scale where manual moderation is becoming an anachronism. By my estimates, more than 11,000 phishing pages are registered worldwide every day, and a significant portion of them live for just a few hours. Generative AI has reduced the cost of creating such resources to pennies, making traditional blacklists useless—by the time a site is added to the registry, it has already done its dirty work.
Sber's development tackles this problem in a fundamentally different way. Instead of a single model, the system uses a swarm of multimodal agents, each analyzing a website along its own vector: text, source code, infrastructure, and visual design. The agents don't just check the page—they conduct a full-fledged "trial": some gather evidence in favor of a threat, others look for counterarguments, and then a separate module issues a verdict based on the entire body of evidence.
From assistant to automatic executioner
Currently, the system operates in assistant mode: it performs initial analysis, sets priorities, and prepares a report for a specialist who makes the final decision on blocking. But this is only an intermediate stage. The company's plans include full autonomy, where identified resources will be blocked without human involvement.
The key point is integration with the X Threat Intelligence platform, to which more than 760 Russian organizations are already connected. This transforms the development from an internal tool into an industry standard capable of protecting not only the bank's clients but also the entire corporate ecosystem of the country.
Arms race in security
Sber is not alone in this trend. MTS has already updated the AI models of its "Zashchitnik" service: three neural networks evaluate more than 1,100 parameters of each call, reducing the response time to fraud from 30 to 15 seconds. And Elon Musk has backed Cloudflare's forecast that by May 2026, non-human traffic will exceed user traffic, and within five years—surpass it by 1,000 times.
However, agent autonomy also opens up new attack vectors. Researchers in the U.S. have already demonstrated the Ghostcommit attack: a malicious command hides inside an image, the reviewing agent doesn't open it, while another assistant reads the instruction and transfers passwords into open source code. This is a classic arms race—each new level of protection spawns a more sophisticated way to bypass it.
My conclusion: the transition to multi-agent systems in cybersecurity is inevitable, but full automation of blocking is playing with fire. As long as AI agents act as "advisors," humans retain control. Once that control disappears, false positives could become a more serious problem than the phishing sites themselves.