Small Business Security

Is it safe to run a Terminal command ChatGPT gives you?

Check AI-generated Terminal commands before running them. Obsidian Ridge explains poisoned shared chats, safe checks and what to do after a mistake.

By Kfir Yair, CISSPPublished Updated 6 min read
SMB

Obsidian Ridge offers the assessment described below and is a Huntress partner. The incident findings are Huntress's research; the office checklist is our practical guidance.

Short answer: Do not run a Terminal command from ChatGPT without an independent check of what it does and where it came from. Huntress documented a search-result lure using shared AI conversations to install password-stealing malware. A familiar AI website does not make a stranger's instructions safe. Huntress investigation.

Key facts

  • Safe to paste? Our recommendation, October 23, 2026: have your IT provider check an unfamiliar command before you run it. Incident context.
  • December 2025: Investigating a December 5 alert, Huntress found top-ranked Google results with shared ChatGPT and Grok disk-cleanup instructions that delivered AMOS malware. Original report.
  • July 2026: Huntress investigated MacSync after a sponsored Google result led to a shared Claude conversation posing as an Apple Support installation guide. Technical report.
  • Access mattered: The MacSync chain sought the user's password and Full Disk Access, a macOS permission for broad file access. Technical report, checked October 23, 2026.
  • What to review: The assessment scope covers AI apps and agents on staff devices, their access and risky actions. Offer checked October 23, 2026.

Why can a real AI website contain dangerous instructions?

A shared conversation can be content prepared by another user, so recognize the difference between the host and the person giving the instructions. Huntress describes a disk-cleanup lure using OpenAI's ChatGPT and xAI's Grok sharing features, not a breach of either provider. Huntress.

For an office manager, the useful question is who authorized the change to the work laptop. A search result is not authorization. A realistic support name is not a support relationship. Pause when instructions move from reading an answer to changing the computer.

Free 30-day AI security assessment

Obsidian Ridge's free 30-day AI security assessment finds the AI apps and agents running on staff devices, shows what client data and systems they can reach, and flags risky actions. A CISSP walks you through the findings and recommended fixes. Thirty days, no charge, no card. Implementation and any paid tools are separate.

Built for teams of 10 to 100.

Request my free assessment

What should I check before pasting a command?

Ask your IT provider to explain the action in plain English and verify its source before you approve it. Our suggested checklist is deliberately short enough to use during a busy working day:

  • State the job. Write down what you are trying to fix. Ask whether the computer's ordinary settings can do it.
  • Check the instructions independently. Open a support source you already know or use your established IT contact. Do not rely on a link inside the instructions you are checking.
  • Ask what changes. Will the command download something, install an app, change permissions or remove files? If nobody can explain it, stop.
  • Check permissions separately. Treat a password prompt or a request to turn off a protection as a new decision, not a routine continuation of the guide.
  • Keep approval visible. Record who checked the instructions. Do not ask a colleague to test an unexplained command on their laptop.

On Windows, the same ClickFix tactic can tell staff to paste and run a command in the Run box or PowerShell. Microsoft's ClickFix analysis. Your office rule should cover the action, not just a particular operating system.

What did the fake Mac installation guide try to take?

Huntress reports that MacSync targeted browser cookies, saved logins, keychain secrets, Telegram sessions, and SSH and cloud keys. The last two are credentials used to reach servers and cloud services. The guide abused a shared conversation on Anthropic's Claude platform; the attack chain also asked for additional access rather than automatically bypassing every permission. MacSync analysis.

Our practical response is to consider which work accounts were available on the affected computer. Make that list with your IT provider. Include the practice's file storage and email as well as the application the employee was trying to install. Do not assume that fixing the original disk-space problem answers the security question.

What should we do if someone already ran it?

Disconnect the affected computer from Wi-Fi and wired networking, then contact your IT provider through a different device. These are our recommended first actions while the provider decides how to contain and investigate the incident.

Tell the provider what the person saw and what they remember doing. Preserve the instructions and approximate time if you can do so safely, but do not rerun the command to demonstrate it. Follow the provider's guidance on preserving the computer and reviewing affected accounts.

Change affected passwords from a different, trusted device. Ask the provider to review active sessions and other credentials as well; changing a password should not be treated as proof that every form of access is closed. If client information may have been involved, use your firm's incident process to decide the next steps.

How do we find the AI tools already on our work devices?

Start with an inventory and a review of what each tool can access. Include approved tools, forgotten extensions and agents that can run actions. Record gaps as unknowns, rather than declaring the computer safe because a familiar app appears on the list.

The assessment's published scope is shown below. It gives the business findings and recommended fixes; it is not the emergency-response step for a computer that may already be compromised.

Free 30-day AI security assessment

Obsidian Ridge's free 30-day AI security assessment finds the AI apps and agents running on staff devices, shows what client data and systems they can reach, and flags risky actions. A CISSP walks you through the findings and recommended fixes. Thirty days, no charge, no card. Implementation and any paid tools are separate.

Built for teams of 10 to 100.

Request my free assessment

Sources

Last updated

October 23, 2026. We refresh this content as the threat landscape and tools evolve.

FAQ

Questions readers usually ask next

Is it safe to run commands from ChatGPT?

Only after an independent check of the command and its source. Treat an unfamiliar command as a proposed change to the computer that your IT provider must understand and approve.

Does a shared conversation on a real AI website prove the command is safe?

No. The platform can be genuine while the shared instructions were prepared by someone else. Verify the action through an independent source.

What if the guide says it is from Apple Support?

A support name displayed in shared content is not enough. Use the support route or IT contact you already know to check the instructions.

What should I do after running an unfamiliar command?

Disconnect the computer from the network and contact your IT provider from a different device. Do not run it again. Follow the provider's guidance and change affected passwords from a trusted device.

Does the free assessment replace incident response?

No. Contact your IT provider about a suspected compromise first. The assessment reviews AI apps, agents, access and risky actions; implementation and paid tools are separate.

Full bio & provenanceSee related service

Related reading