Charley | Charlemagne Labs

Agent Charley runs a small language model directly in your browser to catch phishing attempts before you click

11 views

🔍 Click to enlarge

Agent Charley runs a small language model directly in your browser to catch phishing attempts before you click. This system sits at browser level, watching for suspicious links and social engineering tactics that endpoint security typically misses. Everything processes on your device. No data leaves your machine.

The core idea makes sense. Traditional EDR tools can't see what's happening inside browser sessions. Charley fills that gap by analyzing links and credential capture workflows in real-time. When it spots something fishy, it alerts you immediately and blocks the threat. The desktop app works on Windows and Mac, with a browser extension providing the security layer.

Installation happens centrally, which matters for IT teams managing dozens or hundreds of employees. Once deployed, the system tracks incidents through flow graphs and timeline visualizations. You can investigate what happened, when, and how the attack unfolded. This beats getting a simple alert that something bad happened with no context.

The on-device approach deserves scrutiny. Yes, privacy stays intact since nothing transmits externally. But small language models have real limitations compared to cloud-based systems with massive training data and constant updates. How well does a local SLM actually identify novel phishing techniques? The facts don't say. No detection rate statistics. No comparison against traditional email filters or other anti-phishing tools.

Browser-level protection sounds thorough until you think about attack vectors outside the browser. What about phishing through Slack, Teams, or text messages? This system only guards one entry point. Social engineering happens everywhere. An employee could still get compromised through a dozen other channels.

The team brings serious credentials. Over 12 years at Meta for the founder. Multiple members with 10-15 years in engineering and cybersecurity. That experience shows in the product's focus on practical deployment rather than flashy features. But experience doesn't guarantee the AI model performs well against sophisticated attacks.

A free plan exists, confirmed by external sources. That's notable for enterprise security software, which usually requires lengthy sales calls before you see pricing. Testing this system costs nothing upfront.

The facts skip crucial details. How many organizations currently use it? What percentage of phishing attempts does it catch? How many false positives does it generate daily? Security tools live or die on accuracy metrics. Without those numbers, you're buying on faith. The concept works. The execution remains unproven in the available information.