Malwarebytes has launched a new connector for Anthropic’s Claude AI, designed to help users verify the legitimacy of suspicious communications directly within the chat interface. The integration allows users to input potentially malicious links, phone numbers, or email addresses, which the AI then cross-references against the Malwarebytes threat database. This tool is accessible to both free and paid Claude users and does not require the creation of a separate Malwarebytes account to function.
The connector operates through six distinct tools that provide various analytical capabilities, such as performing domain registration lookups, scanning multiple items simultaneously, and submitting reports on suspected scams. Users maintain granular control over these functions through a permission management system. Each tool can be configured to prompt the user for approval before execution, set to always allow access, or completely blocked to prevent the AI from utilizing that specific feature.
In practical testing, the integration has demonstrated an ability to flag common indicators of phishing and social engineering. When presented with screenshots of fraudulent text messages—such as those impersonating government agencies or delivery services—the connector provides contextual analysis alongside technical data. For instance, in cases where a phone number is not explicitly identified in the threat database, the AI can still provide a risk assessment based on metadata, such as suspicious international country codes or the presence of high-pressure language intended to force a victim into immediate action.
The tool also provides visibility into the destination of shortened URLs. By analyzing where a link redirects, the connector can help users determine if a web address leads to a legitimate corporate portal or a malicious site, often without the user needing to click the link themselves. In instances where a link is found to be offline or redirected to an unexpected domain, the integration provides enough information for a user to verify the communication through official channels, such as a company’s verified mobile application.
While the connector provides valuable insights, the results returned by the Malwarebytes database are not always definitive. Tests have shown that the system may return an "Unknown" status for certain phone numbers or links that have not yet been flagged by security researchers. In these instances, the value of the tool lies in the AI’s ability to synthesize the available information and highlight red flags that a casual user might overlook.
The integration represents a shift toward agentic AI workflows in cybersecurity, where automated tools act as an intermediary between the user and potentially dangerous digital content. By embedding threat intelligence into a conversational interface, the connector aims to reduce the likelihood of users interacting with phishing attempts. The ability to scan screenshots directly is a notable feature, as it allows for the analysis of visual media that would otherwise be difficult to verify without manual investigation.
The effectiveness of this integration relies heavily on the user’s willingness to manage tool permissions and interpret the findings provided by the AI. Because the system is designed to assist in decision-making rather than provide a guaranteed security verdict, it is intended to serve as a secondary layer of verification. Users are encouraged to use the provided data to make informed choices about whether to engage with a message, rather than relying solely on the tool to block all threats automatically.
As of the current release, the connector is available for integration within the Claude platform. It remains a voluntary tool that requires active user input, such as uploading a screenshot or pasting a link, to initiate a scan. By keeping the user in the loop through the permission-based toolset, Malwarebytes and Anthropic have created a system that prioritizes user agency while providing access to professional-grade threat intelligence.
