Confirmed phishing
Credential theft at the reported resource.
Recommend prompt, justified mitigation.
Recheck: abuse disrupted
AI Abuse Playbook
Act fast on real abuse. Keep legitimate sites online.
A free, reusable AI abuse playbook for Claude Code and Codex. It checks the evidence, picks the right branch and leaves the final decision with your team.
The workload
Abuse takes almost half the queue.
46%
of support tickets at NIC.UA and NicNames concern abuse
Support data, Jan–Sep 2026
Send the same complaint ten times, get ten investigations.
Too slow
Real abuse remains active.
Evidence waits across separate systems. Victims keep reaching the harmful page.
Too fast
A legitimate service goes offline.
A competitor repeats the same allegation. Urgency replaces an evidence check.
A repeatable investigation helps the team avoid both.
The weaponized report
A complaint designed to trigger a suspension.
URGENT — MALWARE / LEGAL NOTICE
09:14
Dear Sir or Madam,
The domain example-bakery.test is spreading malware to our customers. You must suspend it immediately, or we will escalate this matter legally.
We have already notified multiple authorities. Please see the attached screenshot as evidence.
Regards,
Legal Department
What to verify
- Does the screenshot match?
- Is the exact URL supplied?
- Can the harm be reproduced?
- Is the legal claim authentic?
- What would suspension affect?
The target is a small bakery's website. A rushed suspension would also take down its online orders and email.
Illustrative example — not a real report.
The playbook
A playbook your AI agents can follow.
- 01
Receive and preserve
Original report, language, resource and response clock
- 02
Check the evidence
URL, context, threat feeds, policy and prior reports
- 03
Select a branch
Enough evidence, missing evidence or mixed findings
- 04
Authorized review
Confirm, change, reject or escalate
- 05
Complete the action
A response, notice or approved intervention
- 06
Record and recheck
Sources, reasons, action and verified outcome
Failed checks are retried or escalated.
Get the full playbook
Prompts, evidence checks and decision branches, ready for Claude Code or Codex.
The decision
Evidence determines the next step.
What did the checks find?
Not enough evidence
Investigate what is available. Ask the reporter for the missing details.
Clear evidence of abuse
Recommend a prompt, proportionate response. Explain the reasons.
Conflicting signals
Escalate to a person. State what remains unknown.
Before any recommendation, the evidence is checked twice. If a check can't run, nothing is assumed safe.
Examples
Not every report deserves the same response.
Hacked legitimate site
The harm is limited to one compromised resource.
Target the compromise. Set an owner and deadline.
Recheck and escalate
Weak evidence
The screenshot shows a different URL.
Investigate available facts. Request missing specifics.
Reassess new evidence
Permissions
AI prepares. Your team decides.
AI prepares
- Analysis and reasons
- Draft response
- Missing evidence
- Proposed next step
Your team decides
- Confirm
- Change
- Reject
- Escalate
Enforcement waits for authorized review by default.
Reports can hide instructions aimed at AI. The playbook treats every report and web page as untrusted, so the agent reads them but never takes orders from them.
Two ways to run it
Run it yourself, or with Jexi.
Jexi is built by the team behind NIC.UA and NicNames, who handled these reports for years.
Claude Code / Codex
Build it yourself
- Connect the inbox and evidence tools.
- Arrange feed access and licensing.
- Maintain APIs, retries and follow-up.
An AI ticket coworker
Jexi
- Bring the playbook into your ticket system.
- Give the team multilingual conversations.
- Simplify connections to evidence services.
Abuse workflows · closed beta
Request beta accessAnalysis, routing and retries run today. Next: URL checks, threat feeds and registrar API actions.
Data and security
With Jexi, your data stays in your Google Workspace.
Jexi works on top of your team's Gmail. Abuse reports carry personal data, so we built it to leave that data where it already is.
Stays in your Workspace
Reports, threads and attachments stay in your Gmail and Google Workspace.
No permanent copy
Jexi keeps only a short-lived cache while a case is processed. We don't store your data.
Verified by Google
Jexi has passed the security audit Google requires for apps that work with Gmail data.
Take the playbook back to your team.
- Agent instructions and prompts
- Evidence checks and decision branches
- Integration checklist and example cases
Free. We'll ask for your work email.