Meet NEdirbantis1, the AI Agent That Became Our First Full Time Employee
How KTU, the Ministry of Culture and Nelegalus fight illegal online content in Lithuania, with an AI agent at work and people deciding
Prof. dr. Šarūnas Grigaliūnas, Head of the Cyber Security Centre of Excellence (KTU)
Every month, people in Lithuania make about 15.3 million visits to pirate websites. According to the 2025 study by INAC, the Lithuanian Intellectual Property Protection Centre, 77.2 percent of audiovisual traffic in the country goes to pirate sites, roughly 3.4 times the traffic of legal video on demand platforms. Ten websites generate 78 percent of that pirate traffic.
Those numbers are not an abstraction. Behind every illegal stream is a film crew, a musician, a writer or a small studio that does not get paid. Behind many “free” IPTV offers and replica shops are scams, and some of these domains are linked to sanctioned media.
So at Kaunas University of Technology we tried something new. What if the first full time member of the team fighting this problem was not a person at all?
Where the project comes from
The Cyber Security Centre of Excellence (CSCE) at KTU works on cyber resilience, AI security, digital forensics and post quantum security. Its principles are science based action, practical value, collaboration, prevention, openness and responsible use of technology.
The groundwork was laid in 2025. That year a feasibility study was prepared for the Lithuanian Ministry of Culture on a technological solution to restrict access to illegal content online. It found that about 40 percent of people in Lithuania at least sometimes consume illegal content, mostly films, series, music and sport broadcasts. Among its recommended building blocks were a browser extension that warns users and points them to legal alternatives, a central database of illegal websites that other systems can read through an API and that is updated at least once a day, and a system for handling reports from trusted flaggers.
In parallel, KTU and the Ministry of Culture prepared a cooperation agreement, first drafted in May 2025 and signed in March 2026 by Minister of Culture Vaida Aleknavičienė and KTU Rector Eugenijus Valatka. The agreement links state institutions and the research community in cyber security, information resilience and the regulation of digital content. KTU contributes research, analysis, expert assessments and methodological recommendations, and the Centre of Excellence coordinates the work on the university side. According to the Ministry’s public announcement, the cooperation explicitly includes a model of a technological solution for the automatic identification of illegal content online, sharing good practice on stopping the spread of such content and the circumvention of access blocking, and cyber security training for the cultural sector (https://www.elektronika.lt/naujienos/svietimas/100423/kulturos-ministerija-ir-ktu-sutare-bendradarbiauti-stiprinant-intelektines-nuosavybes-apsauga/).
The third institution in the picture is the Radio and Television Commission of Lithuania (LRTK). Under the Law on Provision of Information to the Public and a procedure approved by the Minister of Culture in 2019, LRTK can order internet access providers to block domains. Blocking a primary infringing website requires sanction from the Vilnius Regional Administrative Court, while new mirror copies of an already blocked site can be blocked by LRTK decision alone. Providers must block the domain at DNS level within five days, and visitors are redirected to an LRTK information page. LRTK publishes these decisions as open data, in three lists covering websites that infringe copyright (https://www.rtk.lt/lt/atviri-duomenys/interneto-svetaines-kuriose-pazeidziamos-autoriu-teises), operators that distribute TV programmes to Lithuanian viewers without notifying the regulator (https://www.rtk.lt/lt/atviri-duomenys/neteisetos-veiklos-vykdytojai) and domains giving access to TV channels under EU sanctions (https://www.rtk.lt/lt/atviri-duomenys/ribojimai-susije-su-tarptautiniu-sankciju-igyvendinimu).
Nelegalus (https://www.nelegalus.lt/en) is our practical answer to that challenge.
What Nelegalus is
Nelegalus describes itself as a human reviewed register of illegal content. It brings together three things.
- A browser extension. Available in the Chrome Web Store, it checks the domain you are visiting against the public register. Reading the register needs no account. Users with an approved account and a personal API key can report a suspicious page in a few clicks. Only the URL, a category and a description are sent, never the page content.
- A review process. Every report lands in a queue. The review team assesses the evidence, confirms or rejects it and records a reasoned decision. Every action has a status, a responsible person and an audit record.
- A public register. Confirmed domains are published on the website and in machine readable JSON and XML feeds, so other systems can use them. The register also imports all three official LRTK lists twice a day, so the regulator’s decisions and the community’s confirmed reports sit in one place.
At the time of writing, the register holds 3,079 confirmed domains.
Meet the first full time employee
Here is the part that makes this project different. The first full time employee of Nelegalus is NEdirbantis1, a Grok Bot AI agent. Its name is Lithuanian wordplay. “Ne dirbantis” means “the one who does not work”, and the NE echoes NElegalus. In reality it works every single day.
Its job is the daily search for illegal content. Twice a day, around 10.00 and 18.00 Vilnius time, it browses a fresh sample of Lithuanian websites. It looks for pirate film, series and anime sites, illegal IPTV and sport streams, pirated books, audiobooks and games, counterfeit goods, fake investment offers and casinos, and it checks sites from the Bank of Lithuania’s list of illegal financial service providers that are still online. A typical run covers about 25 to 45 sites.
Get Šarūnas Grigaliūnas’s stories in your inbox
Join Medium for free to get updates from this writer.
It works as an ordinary user of the platform, with the same rights as any volunteer. Before reporting anything it checks the public register and its own log, so it never reports a domain twice. Most of the sites it opens turn out to be licensed services or are already in the register, and it leaves them alone. Only well founded findings, with evidence and a short description, go into the review queue. After each run it sends a short report to its supervisor.
That supervisor is a second AI agent, NElegalus, the administrator agent. NElegalus reviews the queue every day, flags duplicates, prepares the work for human reviewers and gives NEdirbantis1 feedback.
One example shows why this matters. During one run NEdirbantis1 reported several legitimate Lithuanian news portals because they had published paid articles promoting crypto “cloud mining” schemes. NElegalus noticed that the register works at the level of whole domains, so listing a news portal would be unfair and wrong. It advised rejecting those reports and gave NEdirbantis1 a new rule, to report the scam platforms themselves and use the article only as evidence. NEdirbantis1 added the rule to its routine the same day, together with stricter rules to report only pages it has opened itself and only sites whose main purpose is illegal. That is the kind of learning you would expect from a careful junior analyst.
Why the AI never gets the final word
Now the most important sentence in this story. The AI agents do the work, but people make the decisions.
This is not a slogan. It is written into the rules of the platform. The Nelegalus terms of use say that a report is not a legal decision, only a signal for human review, and that the final decision on user reports is made by the review team, “rather than an algorithm or LLM”. In practice NElegalus passes every report to manual review. Neither agent confirms a single domain on its own.
The same principle applies to access. Administrator and reviewer accounts are protected with multi factor authentication. When the administrator agent’s session expires, it cannot sign itself back in. It stops, reports that it is blocked and waits for a person to sign in. Nothing is entered on its behalf and nothing is changed.
We think this is the right shape for AI in public interest work. Automation gives you speed and consistency. Humans give you accountability. A register that can affect a website’s reputation needs both.
Privacy by design
Fighting illegal content should not create a new surveillance problem. The extension does not collect browsing history and does not use advertising analytics. The current domain is compared with a copy of the register stored on your device. Secrets such as API keys stay in local browser storage. An optional AI second opinion in the extension sends visible page text only to a provider the user chooses, and only after the user reviews and confirms it. The reporter’s email is never published in the register.
What we are learning
Three lessons stand out so far.
First, an AI agent is a superb full time colleague for the first line. It is fast, patient and consistent, and it writes everything down.
Second, the hard part is judgment, not detection. Distinguishing a pirate site from a licensed platform, or a scam from a news portal that ran a bad advert, is exactly where human review earns its place.
Third, transparency builds trust. Public feeds, reasoned decisions and audit logs mean that anyone can see what the register contains and why.
Join us
Nelegalus is open to people who want to help. If you work in film, music, publishing, sport broadcasting, cybersecurity or law enforcement, or if you are simply tired of seeing scams dressed up as free entertainment, there are three ways to take part.
- Install the NElegalus extension and check the sites you visit.
- Apply for an account and report what you find, so our reviewers can assess it.
- Use the public JSON or XML feed in your own tools and research.
If your organisation would like to cooperate on research, training or integration, the KTU Cyber Security Centre of Excellence would be glad to hear from you.
Learn more about the project at https://www.nelegalus.lt/en and about the Centre at https://cyber.ktu.edu
Technology helps. People decide.
