What happened
The user was turning a PowerPoint into material for investors. Partway through, the chat showed a message about "elevated automated traffic" and said a security check was needed. It was signed "OpenAI Security Team" and had a link.
The link led to a page made to look like an OpenAI check. It copied a command to the computer's clipboard and told the user to press Win + X, open Windows Terminal, paste, and press Enter. That command would have downloaded and run a program from the attacker.
The user tried twice. The computer's security software shut down both attempts, and the IT team's security provider found no sign the program ever ran.
Tell your staff
That software is what saved them. Make sure every computer in your office has security protection that can stop a bad command. Ask us if you are not sure yours does.
What nobody knows yet
The IT person who wrote the report is honest about it: they do not know why that message appeared inside ChatGPT. They are not saying OpenAI was broken into, and OpenAI had not commented as of October 10.
So please do not walk away thinking ChatGPT is unsafe or that it was proven to be attacked. This is one team's report. What we do know is what the trap looks like.
Tell your staff
If you want to be careful with AI tools, pick which ones your staff may use and write it on one page. It takes ten minutes.
The trick has a name
Security people call it ClickFix. A fake "verify you are human" or "fix this error" message talks you into pasting a command into Windows yourself. Microsoft wrote about it in August 2025, and a security company called Proofpoint wrote about it back in November 2024.
It works because you are the one doing it. No virus sneaks in. You let it in, because the message looked official. This time the message showed up in a tool people already trust, which makes it feel more real.
Tell your staff
No real website, "are you human" box or security check will ever ask you to paste a command into Windows. If a page says to press Win + R or Win + X and paste, close it and call us.
The short version
Never paste something because a website or a chat told you to. Say it to your staff in those words. Then check that every computer has protection that can stop a bad command.
If someone in your office already did something like this, call us right away. Do not wait and do not feel bad. It happens to smart people.