An email from noreply@x.ai landed in my inbox, passed SPF, DKIM, DMARC, and had the blue check Something felt off, so I asked @bot to do a security review. It found a hidden phishing link, explained why every safety check passed, wrote a report to xAI - including proposed fix!