LLM-Based Autonomous Agents for Phishing Detection, Triage, and Response

Abstract

This chapter presents an agentic intelligence framework for autonomous phishing detection and response in the context of evolving cyber warfare strategies. It introduces the Autonomous Phishing Detection and Action (APDA) architecture, which integrates large language models with perception, reasoning, action, and feedback layers to enable adaptive and explainable decision-making. This chapter examines how adversarial techniques, such as prompt injection, jailbreaking, hallucination, and data poisoning, threaten LLM-based cybersecurity systems, and outlines the corresponding mitigation strategies embedded within each architectural layer. A structured evaluation framework is proposed, including technical and operational metrics, alongside an illustrative enterprise email threat scenario. This chapter contributes a novel layered approach that bridges advances in natural language processing with autonomous cyber defense, offering a scalable and governance-aware solution for next-generation security operations.