Inspiration

With AI becoming a bigger problem for cybersecurity, we wanted to come up with a solution to help mitigate it. Phishing attacks are already such a large attack vector, and it's only become more sophisticated with the help of AI. Traditional systems only detect previously known patterns, but LLMs make it possible to easily bypass those checks. LLMs provide a great opportunity to not only bypass current systems, but detect those bypasses just as easy as previous techniques.

What it does

Argos uses LLMs to scan content for malicious behavior and provide some sort of report for it's decision. It can scan multiple different kinds of content, such as text or arbitrary files. For this project, we show how it can be used to detect malicious emails, or to scan any file/link you give it.

How we built it

We used Python with FastAPI, Uvicorn, and Pydantic for the backend because Python is very simple to use and does everything we need it to do. For the frontend, we used TypeScript, React, and Vite since it's also a relatively standard frontend and has lots of resources. We use the OpenRouter API for LLMs. We also used Docker for sandboxing and Mailpit for a simple email server. We also used coding harnesses like Codex and Claude Code to assist in building the project.

Challenges we ran into

The most difficult part was probably selecting the right LLM to use and how to engineer around it. We have to pick the right model to balance between cost and capabilities, while also making sure it's able to properly work within the pipeline. Getting everything to look nice is also hard since none of us are very good at design.

Accomplishments that we're proud of

We're really happy that the project works in general, as it's proof that the concept works and could be used in real environments. It's really cool to see how the LLM analyzes files and looks for malicious behavior.

What we learned

Picking the right LLM for the job isn't as easy as we thought it'd be, and even pretty small LLMs are surprisingly better than we thought at not so trivial tasks, such as identifying malicious behavior in arbitrary files.

What's next for Argos

The system of giving an LLM some input and doing complex analysis for malicious behavior doesn't just have to be for emails or file upload. It could eventually extend to other pipelines, or even something running locally on your computer to scan for malicious files. The whole idea of using LLMs for detection is surprisingly underutilized, especially with cheap LLMs improving so much.