What AI tools are my employees using? How to find out
Find the AI apps, extensions and agents staff use. Obsidian Ridge explains what to check and how its free assessment reviews access and risky actions.
Read articleSmall Business Security
Fake AI app downloads: how to spot a poisoned Claude or ChatGPT ad
Huntress and Cato report fake AI download campaigns. Obsidian Ridge explains the lures, safer installation checks and the limits of trusted domains.
SMB
Obsidian Ridge offers the assessment described below and is a Huntress partner. This analysis attributes the incidents to the researchers; the BleepingComputer source is sponsored content written by Huntress, not independent corroboration.
Short answer: Verify AI downloads through a vendor address or publisher listing your administrator trusts. Researchers documented fake AI installers. Skip sponsored download results and have work-app installations approved before running them. Huntress; Cato.
Key facts
- Can a real AI site host a fake? Yes: FakeAgent used a Claude Artifact impersonating a Claude Desktop download page to deliver SectopRAT. Huntress.
- Reported count: At least 29 organizations, observed July 21 and 22, 2026. Huntress.
- Removal: Huntress says Anthropic had removed that artifact by publication on July 22; the later overview reports related redirect activity through August. Original report; overview.
- Short-lived content: Huntress's overview describes a nine-month observation window and lures that can last hours or days before removal. Overview, checked October 23, 2026.
- Separate Codex lure: Cato's August 24, 2026 report describes fake Codex download instructions reaching Mac users through sponsored search. Primary report.
Why does a familiar domain fail as a safety check?
A genuine host can carry user-created installer impersonations, as FakeAgent demonstrated. Huntress.
Our advice is to verify the installation route and the proposed action together. A brand name, polished layout or place near the top of a search result is not enough evidence for an office to approve a software change.
Free 30-day AI security assessment
Obsidian Ridge's free 30-day AI security assessment finds the AI apps and agents running on staff devices, shows what client data and systems they can reach, and flags risky actions. A CISSP walks you through the findings and recommended fixes. Thirty days, no charge, no card. Implementation and any paid tools are separate.
Built for teams of 10 to 100.
Request my free assessmentHow should staff get an AI app for work?
Use the vendor address your administrator has independently verified, or a verified publisher listing in the official app store. Our recommendation is to bookmark the approved route and put it beside the office's approved-app list.
- Type the known address yourself. Do not take the address from the ad or guide you are trying to check.
- Skip sponsored download results. Search position does not authorize an installation.
- Verify the publisher and task. Confirm that the download matches the app the business approved.
- Stop at unfamiliar instructions. A request to paste a command, disable protection or enter an account password needs separate IT review.
- Report a suspect result. Send the description to your established IT contact without asking another employee to try it.
These are Obsidian Ridge's recommended checks, not product advice for or against any AI provider. A genuine app also needs an approved business use and account configuration.
What does the separate fake Codex campaign show?
Cato reports that sponsored searches led to Google Sites pages impersonating an OpenAI Codex download portal and then to malicious Mac installation instructions. Its current report links the delivery framework to known AMOS activity; it does not justify treating the final malware identification as certain. Cato.
The lesson we draw is to check the complete installation path. A page can borrow a trusted service's name without being that service's download page. If the instructions switch to a terminal command, that is a different action from downloading an app the administrator already approved.
Why do controls on the computer still matter after a takedown?
Removing a lure does not establish that a downloaded file or installed program has been removed from a work device. Our recommendation is to review the actual device activity and install history when a staff member reports a suspicious download.
Ask the IT provider which applications may run, who can approve an exception and how a suspicious installation is investigated. Do not ask the office manager to determine whether a malware file is safe by opening it. Preserve the information needed for the provider's review and follow its containment instructions.
Timeline
- July 21 and 22, 2026: FakeAgent observations. Original investigation.
- July 22, 2026: Artifact removed by publication. Huntress.
- August 2026: Related redirect incidents. Huntress.
- August 24, 2026: Cato published its separate fake Codex investigation. Cato.
- Current status at this update: The cited reports document historical incidents and a specific artifact removal; they do not establish that every related lure or infected device has been cleared.
Indicators for security teams
Use these historical indicators to support an investigation, not as a complete block list. We omit executable commands and link only to the researchers' reports.
| Observed item | How to interpret it | Source |
|---|---|---|
Claude Artifact on the genuine claude.ai domain | Historical lure host | Huntress |
downloading-api[.]it[.]com | Defanged redirect indicator; do not visit | Huntress |
| OpenAI branding on a Google Sites page | Cato's reported impersonation, not an official OpenAI download location | Cato |
Our recommended next step for an owner is a device inventory that records which AI apps and agents are present and what they can access. Use it alongside the IT provider's investigation of any suspected compromise.
Free 30-day AI security assessment
Obsidian Ridge's free 30-day AI security assessment finds the AI apps and agents running on staff devices, shows what client data and systems they can reach, and flags risky actions. A CISSP walks you through the findings and recommended fixes. Thirty days, no charge, no card. Implementation and any paid tools are separate.
Built for teams of 10 to 100.
Request my free assessmentSources
- Huntress FakeAgent: July 22, 2026.
- Huntress AI attack surface overview: historical campaign window and follow-on observations.
- Cato fake Codex investigation: primary report; August 24, 2026.
- BleepingComputer, September 11, 2026: sponsored and written by Huntress Labs.
- Obsidian Ridge assessment scope: approved offer. Sources checked October 23, 2026.
Related reading
- Is it safe to run a Terminal command ChatGPT gives you?
- How to stop employees pasting client data into ChatGPT
- What AI tools are my employees using? How to find out
- AI agents on work laptops: what can they reach?
- Compare AI security assessments
- Write an AI usage policy
- Recognize device code phishing
Last updated
October 23, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
Questions readers usually ask next
Can a fake AI download page appear on a genuine platform?
Yes. Verify the content author and the installer source independently.
Does an ad mean the download has been approved by the AI provider?
No. Our recommendation is to reach the provider through an independently verified address or approved app-store listing rather than a sponsored download result.
Did removing the FakeAgent page clear affected computers?
No. A page removal does not establish device cleanup.
Should I open a suspect installer to check it?
No. Give your IT provider the details through your established support route and follow its instructions. Do not ask another employee to run it.
How does the assessment help with unfamiliar AI apps?
It reviews AI apps and agents on staff devices, their access and risky actions. It does not replace incident response after a suspected compromise; implementation and paid tools are separate.
Related reading
Keep going
Is it safe to run a Terminal command ChatGPT gives you?
Check AI-generated Terminal commands before running them. Obsidian Ridge explains poisoned shared chats, safe checks and what to do after a mistake.
Read articleHow to stop employees pasting client data into ChatGPT
Stop client data reaching unapproved AI tools with approved accounts and tested controls. Obsidian Ridge explains how to put an AI policy into practice.
Read article