Keeper Security has introduced a new anti-phishing feature for its browser extension that uses a local artificial-intelligence model to warn users before they enter credentials on suspicious login pages. The company says the capability inspects page structure and domain signals on the user’s device and does not share personal data with Keeper.
How the feature evaluates risky pages
Keeper described the tool as a zero-knowledge local AI engine that checks web pages for structural indicators often used by credential-harvesting sites. According to the company, those signals include:
- Domain impersonation: look-alike characters and typosquatting that mimic brand names.
- Obfuscated infrastructure: login fields hidden in unusual URL structures, suspicious IP addresses or other buried links.
- Deceptive requests: unofficial sites actively asking for passwords or other credentials.
When the extension detects a suspicious page, Keeper says it immediately notifies the user and displays the specific pattern it found. Users can view the threat breakdown, dismiss the warning, or disable Keeper on that site. Administrators and individuals can restore access or re-enable autofill later from a blocked-sites list managed through the extension or the Keeper Admin Console.
Privacy and controls
Keeper emphasized the privacy design. The company described the protection as running on the device and built on a zero-knowledge architecture, meaning Keeper does not receive the user’s credentials or browsing data for the detection process. The company also said the feature is optional and disabled by default, and that IT administrators may enable and manage it centrally while end users can change settings in the browser extension.
The announcement frames the tool as a response to modern phishing tactics that increasingly use generative AI to craft convincing look-alike domains and deceptive login portals. Keeper cited the 2026 Verizon Data Breach Investigations Report, noting that credential abuse was involved in nearly 40% of breaches documented in that analysis.
Keeper’s approach reflects a broader move by security vendors to shift some detection to users’ devices — a model that aims to combine machine learning with privacy-preserving architectures. The company said the extension’s local model analyses pages for common indicators tied to credential theft and then notifies users of the risk patterns it identifies.
Keeper’s release did not include an explicit rollout date or a list of supported browsers in the text provided. The company explained administrative and user controls but did not publish additional deployment timelines in the material shared.
Implications for consumers and IT managers
- For consumers: the extension will warn about suspicious login pages and keep detection local to the device, according to Keeper.
- For enterprise IT: administrators can centrally enable and manage the capability through the Keeper Admin Console, while end users retain local control.
