Build an AI Security Sidekick
Browser-based
Build an AI Security Sidekick
Turn your AI assistant into a second opinion on suspicious messages—then test how well it spots risk.
What you’ll build
A reusable phishing-check prompt that identifies warning signs, cites evidence from the message, and suggests how to verify safely. Important: the assistant can spot suspicious characteristics; it cannot authenticate a sender or prove a message is safe.
1. Create your checker
- Open a new chat in ChatGPT, Claude, or Gemini.
- Copy the prompt below and paste it into the chat.
- Submit it, then return here for the test messages.
Checker prompt — copy and paste
1. Verdict: Likely scam, Suspicious, or Likely legitimate.
2. Red flags: each warning sign you see, with the exact words from the message that show it.
3. Reassuring signs: anything that suggests the message is genuine.
4. How to verify: what I should check, using contact details I already have rather than any in the message.
5. Next step: one clear action.
Never tell me to click a link, open an attachment, scan a QR code, or call a number from the message. If you can’t tell, say so and default to Suspicious.
2. Test five sample messages
Open each fictional message, copy its text (including sender and subject), and paste it into the same chat. Run A through E one at a time. Compare the AI’s reasoning: What evidence did it cite? Did it recommend independent verification?
>Sample A · Agency onboarding packet
We were impressed by your profile and would like to offer you an ongoing regulatory writing contract at $95 per hour. To add you to our vendor system today, please complete the secure onboarding form with your Social Security number, a photo of your driver’s license, and your bank account details for direct deposit: apexmedcomm-onboard.net/form. Your first project brief will follow once your details are verified.
>Sample B · Sponsor file share
Halvern Clinical Operations has shared a confidential document with you for review. This link expires in 12 hours. Sign in with your work email and password to view: halvern-docs-secure.net/view/csr204
>Sample C · Flattering journal invitation
Dear Esteemed Author, we have read your outstanding work and invite you to write a review article for our special issue. Peer review in 72 hours and publication within one week are guaranteed. An article processing charge of $899 applies. Submit by Friday to secure your place.
>Sample D · Coauthor’s urgent request
Hi, it’s Rachel. My university email is down and I’m traveling. Could you send the latest manuscript draft, including the unblinded efficacy tables, to this address? I need it for a grant deadline tonight. Thanks so much, Rachel
>Sample E · Agency kickoff
Hi, thanks for returning the signed statement of work last week. Confirming our kickoff call Thursday at 2 pm Eastern on the Zoom link in the calendar invite I sent. The source documents will be in our usual client portal by Wednesday; let me know if your access has lapsed. Thanks, Marcus
3. Evaluate the results
Did the checker identify both suspicious and reassuring signs? Did it support its verdict with specific words from the message? Did it recommend contacting the purported sender through an independently known channel?
>Reveal the facilitator answer key after you finish
A — Likely scam: unexpected onboarding request for identity and banking details; verify the agency independently.
B — Likely scam: unusual file-share domain, short deadline, credentials request; contact a known sponsor/agency representative.
C — Likely scam: generic praise, guaranteed rapid review, fee and deadline; investigate the journal independently.
D — Suspicious: personal email, urgency and request for unblinded data; verify with the coauthor using an established channel.
E — Likely legitimate in the exercise: routine kickoff referencing an existing agreement; text alone cannot verify authenticity.
Optional stretch: make it reusable
Save your prompt in a reusable assistant or project if your account supports that capability (for example, a Gemini Gem, a Claude project, or a ChatGPT GPT). Otherwise, keep the prompt in a secure personal reference document.
>Optional agent extension · Connected personal inbox
Only if your platform supports email integration: connect a personal inbox with no confidential client or sponsor material, review the permissions, and run the following in the chat containing your checker instructions. This is an on-demand, read-only exercise, not a scheduled autonomous scan.
The AI may require connector permissions or approval. If it cannot retrieve messages, it should say so. Do not grant access to a professional or confidential inbox for this workshop.
All example names, companies, and addresses are fictional training materials. Any domains appearing in sample messages are text to analyze, not links to visit.