A sponsored Google result for OpenAI Codex led a developer to a Mac infostealer
A developer searched Google for OpenAI Codex, ran the install command from the first result, and then spent the day working out what had already been copied off their Mac.
How the attack worked
The developer described the incident on r/OpenAI on August 17. The top search result was a sponsored ad that appeared to point at a Google URL and led to a fake installation page hosted on Google Pages. The command on that page was built to pass a casual glance: an echo that printed a legitimate-looking npm line and an openai.com address, followed by a curl that fetched a base64-encoded URL and piped whatever that server returned straight into zsh. The payload host had nothing to do with OpenAI.
Afterwards, the developer found no rogue LaunchAgents, no modified shell profiles and no persistent process. That absence leaves the worst case open rather than closed. It is consistent with a one-shot infostealer, a script that copies browser passwords and cookies, keychain items, SSH keys and API tokens, uploads them and exits, leaving nothing behind to find.
Not an isolated page
This is a pattern, not a one-off. Kaspersky flagged the same technique in March 2026: sponsored search ads leading to pages that copy official install documentation. Security firm Straiker has since tracked 88 domains across at least ten hosting platforms, 32 of them still live in mid-May, impersonating Claude Code, JetBrains and NotebookLM among other developer tools.
The targets are telling. These are not consumer brands; they are tools whose install instructions consist of a single long shell command that users paste into a terminal without reading to the end. Developer tooling has quietly become prime phishing real estate for exactly that reason.
Why no vulnerability was needed
The attack exploits nothing in Codex, nothing in macOS and nothing in the browser. It needs three ordinary things: a search ad, a page that looks like documentation, and the habit of trusting the first result. Each of those is a feature of how the web and developer workflows normally operate, which is why the technique keeps reappearing across hosting platforms and brand names.
The blast radius is what makes it serious. Anything the developer has ever authenticated in that terminal is in scope, from SSH keys to the API tokens for the very AI services the fake page was impersonating. The practical defense is unglamorous. A command that starts with a familiar name is not a command you have read, and an install line that fetches and executes remote content deserves to be read to the last character before it runs.
Sources
ANOTHER News is published by ANOTHER, an AI-native content agency. Daily coverage also runs on Instagram.
Related
3M's paid expert asked ChatGPT to show the company was 0% at fault, and the jury read the prompts
In the lawsuit over the January 2020 Watson Grinding explosion in Houston, which killed three people and damaged or destroyed hundreds of homes, plaintiffs' attorney Will Moye found a five-page "Citation Overlay" in 3M's defense materials and forced production of about 350 pages of ChatGPT prompts written by expert witness Josh Autenrieth of engineering firm KnightHawk, which 3M paid roughly $90,000. Prompts included "create an exceptional expert witness report defending the standard of care at 3M" and "show how 3M is 0% at fault for the explosion at Watson Grinding." Trial testimony put the finished report at 85 to 90 percent chatbot output; Autenrieth, billing $475 an hour, said the AI drafted "a straw man to build off of." On August 11 the Harris County jury awarded $61.5 million and assigned 30 percent of fault to 3M and 70 percent to Watson Grinding. 404 Media first reported the story from the court record.
OpenAI launches a separate ChatGPT for teens that asks guiding questions instead of giving answers
On August 18 OpenAI launched a separate ChatGPT experience for 13 to 17 year olds, rolling out globally on Free and paid personal plans. Its Study Mode responds to a problem with guiding questions and step-by-step prompts rather than a finished solution, a Study Hours setting can make that the default during set times, and quizzes and reminders push toward working the problem. Minors are routed to the teen experience automatically, with stronger defaults around self-harm, violence, eating disorders, dangerous activities and explicit content. Parents can link an account and set limits through opt-in parental controls, but cannot read their teen's chats. TechCrunch and Axios reported the launch and noted that teenagers have been using ChatGPT for schoolwork for three years.
A Claude user reports paragraphs from other people's chats appearing in her replies, twice
A Claude user reports that, while asking about a breathing practice, the model's reply contained a new paragraph that began with the word "user," read like a transcribed voice message from a different person, and which she says she never wrote. She says the same thing happened earlier in a chat about a home renovation, when other people's renovation stories appeared in Claude's answers. When she pointed it out, Claude agreed it saw the pattern and also said a leak between accounts is impossible because user data does not cross; that is the model's self-description, not a statement from Anthropic. She has filed a bug report. The screenshots were shared directly; the original chat is in Russian and the quoted text is machine-translated. This remains one user's report, not a confirmed cross-account leak.