Keeper Security has introduced an opt-in AI feature that scans webpages locally for phishing signals and warns users before they submit credentials to spoofed login pages.
Keeper Security has added an on-device AI phishing warning system to its browser extension, in a move that reflects how browser-based attacks are becoming more deceptive and more automated. The feature is intended to alert users before they submit credentials to a fake login page, reducing the chance that a stolen password is handed over on a spoofed site. According to Keeper, the tool is available as an opt-in setting in version 18.2.0 of its browser extension and is switched off by default.
The company says the system analyses web pages locally, rather than sending browsing data to external servers, using what it describes as a zero-knowledge design. In practical terms, that means the AI engine checks the structure of a site for signs associated with phishing, such as typosquatted domains, hidden login fields in URLs, suspicious IP addresses, unusual link patterns and password prompts on unofficial or untrusted domains. If the page is flagged, users are shown a warning that identifies the risk pattern and can block the site, dismiss the alert or disable Keeper on that page.
Keeper’s release lands at a time when browser security tools are under pressure from a wider wave of malicious extensions and fake AI-branded add-ons. Security researchers at LayerX recently identified more than 30 harmful Chrome extensions disguised as generative AI tools that had been downloaded over 300,000 times, while Microsoft Defender researchers uncovered a fake Perplexity AI extension that secretly monitored searches and typed characters before forwarding users to legitimate search engines. The incidents underline how extension-based attacks can blend into normal browsing and evade casual detection.
The broader threat is not limited to add-ons alone. Security audits reported by Brave and Guardio found serious weaknesses in Perplexity’s Comet AI browser, including scenarios in which malicious content could influence the browser’s actions, mislead users into entering banking details or expose authenticated services to attack. Separately, Palo Alto Networks’ Unit 42 has warned that browser features with elevated privileges can be abused when extensions can inject code into them, illustrating the growing security risk around increasingly capable and autonomous browsers.
Against that backdrop, Keeper is positioning its extension as a preventative layer that intervenes at the point where credentials are entered. Chief executive Darren Guccione said phishing campaigns are now often automated and AI-driven, making them harder for conventional defences to catch in time. Chief technology officer Craig Lurey said the engineering goal was to preserve the company’s privacy model while running analysis entirely on the user’s device. Keeper also says administrators can enable the feature centrally through its admin console, while users can manage blocked sites and restore access themselves.
The launch also fits a wider shift in identity security, as vendors respond to the continued value of stolen credentials in attacks on businesses and consumers. Keeper cited the 2026 Verizon Data Breach Investigations Report, which found credential abuse was involved in nearly 40% of breaches. The company’s latest update therefore adds another layer to a password manager’s traditional role: not only storing and autofilling credentials securely, but also warning when the page requesting them may not be genuine.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
