The most cautious company in AI does not secure its own shared Claude chats.

Anthropic bans public access to Mythos because the model could be dangerous. Anthropic publishes 40-page alignment reports. Anthropic coined the term "AI Safety Level" to classify the risks of its own models. Anthropic is, in public discourse, the company that takes AI safety more seriously than anyone.

On 10 May 2026, we learn that the claude.ai domain serves as a malware distribution vector.

What happened on claude.ai?

Attackers exploited a native feature of Claude.ai: shared chats. Anyone can create a conversation on the platform and make it publicly accessible via a link. That link is hosted under the claude.ai domain.

The attackers created a shared chat titled "Claude Code on Mac", attributed to "Apple Support". The content looks like an official installation guide. It asks the user to open the Terminal on their Mac and paste a command. That command, encoded in base64, silently downloads and runs a malicious script.

That manipulation, getting someone to paste a command into their own terminal, has a name: ClickFix. It is not an isolated curiosity. According to the ESET threat report for the first half of 2025, the technique surged by 517%, becoming the second attack vector behind phishing and close to 8% of all blocked attacks.

The campaign targeting Claude was spotted on 10 May 2026 by Berk Albayrak, a security engineer at Trendyol Group, who reported it on LinkedIn before BleepingComputer documented it. Two distinct variants, relying on different infrastructure but following the same attack chain, were identified. At the time BleepingComputer published, both booby-trapped chats were still publicly accessible, under the trusted domain.

To lure victims onto this page, the attackers bought Google ads targeting queries such as "Claude mac download". The sponsored result displays claude.ai as the destination domain. The URL is genuine. There is nothing to spot.

The operation is anything but anecdotal. Analysing a resurgence of the campaign, active from 12 to 19 June 2026, Zscaler researchers counted twenty-two distinct Google Ads campaign identifiers and seven targeted queries, including one in Chinese, of the "claude ai", "claude code" or "claude mac download" kind. To host their relays, the attackers registered domains dressed up as very ordinary American small businesses, laminate flooring installers or pet sitters, so as to stay under the radar.

How does the MacSync malware work?

The malware, a variant of the MacSync infostealer, runs entirely in memory, through osascript, so it leaves no trace on disk. The payload changes with every download to evade antivirus signatures. Before activating, the script profiles the victim, public IP address, machine name, system version, keyboard language, then checks the keyboard layout: it halts and sends a "cis_blocked" signal if it detects a Russian keyboard or one from a CIS country, a classic signature of East European cybercriminal operations that avoid targeting their own jurisdictions.

Once active, it harvests far more than passwords. To browser credentials, cookies and the contents of the macOS Keychain, Zscaler's analysis adds SSH keys, cloud credential files (AWS), Kubernetes configurations, Telegram Desktop data, cryptocurrency wallet extensions, with dedicated payloads for Ledger and Trezor, and files carrying extensions such as .pdf, .wallet or .kdbx. Exfiltration happens in 10 MB chunks, after which the malware wipes its traces.

The comments in the AppleScript code are written in Russian, which points to Russian-speaking operators, consistent with the filter applied to CIS keyboards.

The irony is not incidental, it is structural

There is something deeply revealing about a company that refuses to make a model "too dangerous" public while hosting, on its own domain, content that actively distributes malware. This is not a marginal contradiction. It is the perfect illustration of a pattern I have been observing in the industry for years: we invest heavily in spectacular risks and neglect the fundamentals.

Anthropic is not alone. Similar campaigns have exploited ChatGPT and Grok: as early as December 2025, the same technique was hijacking their shared chats to distribute the Atomic macOS Stealer (AMOS), an operation spotted by Malwarebytes. A February 2026 variant even reached United States public administrations, state, local, tribal and territorial government organisations, according to the Center for Internet Security cited by the Cloud Security Alliance. As Huntress sums it up, in the analysis that research note relays, the attack "doesn't break trust layers; it weaponizes them all". The pattern is the same: AI vendors build sharing, collaboration and public-access features without treating those features as attack surfaces. Because in their mental model, the risk is in the model. Not in the platform. Not in the infrastructure. Not in the fact that anyone can publish content under their domain with a title that says "Apple Support".

It is exactly the same blindness as companies that invest millions in intrusion detection and leave a service account with administrator rights and a default password on a server exposed to the Internet. The glamorous risk absorbs all the attention. The mundane risk does the damage.

Why does Google Ads remain the vector nobody closes?

The other player in this story is Google. And here the picture is even more damning, because it is not new.

Malvertising via Google Ads has been documented for years. Sponsored results appear above organic results. They display the destination domain in plain text. When an attacker points an ad at a legitimate domain whose open feature they are exploiting, the distinction between legitimate ad and attack vector disappears entirely. Google knows this. Google has the technical means to detect that an ad's landing page contains instructions asking users to run commands in a terminal. Google does not do it.

In 2026, Google Ads remains one of the most effective malware distribution vectors in the world. It is a finding so often repeated that it has stopped being shocking. It should be shocking.

Trust as a product: the real problem

What makes this attack effective is neither the malware (a classic polymorphic infostealer) nor the technique (elementary social engineering). It is the fact that AI vendors sell trust. Their brand, their domain, their interface are signals of credibility. When a user sees claude.ai in the address bar, they no longer ask whether the content is trustworthy. They have already answered.

The attackers understood this before the vendors did. Why build a fake site when you can use the real one? Why manufacture credibility when you can borrow it? The shared-chats feature is an open invitation. No need to compromise anything. All you have to do is publish.

The platforms' response will have to match the scale of the problem: moderation of shared chats, automatic detection of content containing terminal commands, restriction of public visibility, explicit warnings. That is exactly what the Cloud Security Alliance recommends: label what is generated by the AI and what is written by the user, flag shared conversations that contain commands or scripts, and close the blind spot it points to, those shared chat links that platforms have never submitted to the moderation they apply to other model outputs. Once alerted, Anthropic eventually removed the booby-trapped chats. But those are after-the-fact fixes. The missing brick, moderation designed into sharing from the start, was not there.

The paradox of AI safety in 2026

We write reports on the existential risks of AI. We debate the alignment of models. We classify systems by safety levels. We deny public access to models deemed too powerful. And we let our own domain serve as a phishing page because we did not anticipate that a shared chat could be used by anyone other than a well-meaning user.

That is a fairly faithful summary of the state of cybersecurity in general. We anticipate the Black Swan. We ignore the pigeon on the window ledge. We model ten-year catastrophe scenarios. We do not check what is happening on our own platform today.

Anthropic will fix the problem. Google will eventually moderate the most blatant ads. Until the next sharing feature, on the next platform, with the next trusted domain.

The rule remains what it has always been: never download software from a Google ad. And never paste a command into a terminal if you do not understand what it does. Even if the URL is the right one. Especially if the URL is the right one.

---

Sources

• BleepingComputer, "Hackers abuse Google ads, Claude.ai chats to push Mac malware", 10 May 2026
• Cybersecurity News, "Hackers Abuse Shared Claude Chats and Google Ads to Deploy MacSync Stealer", Zscaler analysis, June 2026
• Cloud Security Alliance, research note "AI Chat Trust Weaponized in Mac Malvertising Campaign", May 2026
• Infosecurity Magazine, "ClickFix Attacks Surge 517% in 2025", based on the ESET Threat Report for the first half of 2025