# AI Platforms Are the New CDN: How Attackers Weaponized Your Trust in Claude and ChatGPT
The security industry spent years warning users not to click suspicious links. Now the links look like they came from Anthropic.
Huntress researchers have documented a cluster of campaigns that treat major AI platforms — Claude, ChatGPT, and their ilk — not as targets to compromise, but as delivery infrastructure. The goal is simple: borrow the credibility of a brand that users inherently trust, then use it to land malware, harvest credentials, or trick people into running attacker-controlled code. It's working.
## The Attack Surface Nobody Designed For
Claude Artifacts is a feature built for productivity — it lets the AI generate interactive web content, mini-apps, and documents that users can share with a public URL. Anthropic hosts it. Anthropic's SSL cert validates it. The browser shows claude.ai in the address bar.
Threat actors noticed.
The Huntress findings describe weaponized Artifacts: pages that look like legitimate tools — a PDF converter, a CAPTCHA, a software download — but are built to deliver malicious payloads or redirect users through attacker infrastructure. The kicker is that users arriving at these pages have no obvious reason for suspicion. They were given a claude.ai link. That's supposed to be fine.
The same playbook applies to shared AI conversations. Both Claude and ChatGPT allow users to generate a shareable permalink to a chat. Attackers are seeding these with ClickFix-style lures: fake "verification" prompts that instruct users to run PowerShell commands copied directly from the page. The technique is social engineering with an AI wrapper — but the wrapper matters. A PowerShell command on some sketchy forum is a red flag. The same command presented inside what looks like a Claude troubleshooting session carries borrowed authority.
## SEO Poisoning Gets an AI Tailwind
The sponsored search angle is worth dwelling on, because it compounds the problem significantly.
Search poisoning via paid ads is not new — attackers have been buying Google Ads placements for malicious lookalike sites for years, targeting searches like "download 7-Zip" or "Malwarebytes free." What Huntress documents here is that AI-adjacent searches have become a prime target: people searching for how to use AI tools, how to install AI assistants, how to set up Claude or ChatGPT integrations.
These searchers are often less technical. They came to AI because it promised to make complex things simpler. They are exactly the population that will follow a ClickFix prompt without questioning whether PowerShell should be involved in installing a chatbot extension.
The ad budget required to run these campaigns is low. The conversion rate on a highly targeted, trust-borrowing lure is high. The math works in the attacker's favor.
## ClickFix With a Lab Coat On
ClickFix — the social engineering technique where malicious pages instruct users to manually run attacker-provided commands — has been one of the more durable malware distribution methods of the past 18 months. It sidesteps endpoint detection by making the *user* the execution mechanism. No exploit, no drive-by download: just a person who was told to paste something into their terminal.
The AI platform variant is a refinement, not a revolution. But refinement is what makes attacks scale.
When ClickFix first surfaced in earnest, it was deployed on fake CAPTCHA pages and bogus browser update prompts. Detection improved. Users became (marginally) more suspicious of random sites asking them to run commands. Operators adapted by moving to higher-trust hosting: legitimate cloud storage, GitHub, Discord CDN, and now AI platforms.
Each iteration requires defenders to update their mental model of what "suspicious" looks like. That lag — between when attackers adapt and when defenders catch up — is exactly where campaigns do their damage.
## What Defenders Are Actually Dealing With
The practical problem for enterprise security teams is that blocking these campaigns at the perimeter means making decisions about claude.ai and chatgpt.com traffic. For most organizations in 2026, those are approved domains. They're in the acceptable-use policy. Blocking them creates immediate operational friction for legitimate users.
A few things that still work:
Endpoint behavior monitoring over URL reputation. The payload execution matters more than where the link came from. ClickFix campaigns all share a behavioral fingerprint: the user copies content to clipboard, opens a Run dialog or terminal, and pastes. That's detectable regardless of what site prompted it.
User education needs a refresh. The message can't just be "don't click suspicious links" anymore. Users need a mental model that accounts for *legitimate platforms hosting malicious content*. A claude.ai URL is not a safe URL by definition.
AI governance policies should address sharing features. If your org uses Claude or ChatGPT at scale, you need a policy position on Artifacts and conversation sharing — both for DLP reasons and because these are now documented delivery vectors.
Watch for PowerShell and cmd.exe launched from browser-adjacent processes. This catches the ClickFix execution stage across all its variants, including the AI-dressed ones.
---
## HackWire Analysis
This campaign cluster is the latest chapter in a longer story about attacker infrastructure evolving toward legitimate service abuse — and it represents a meaningful escalation.
Go back five years: attackers used compromised WordPress sites and bulletproof hosting. Then came the pivot to legitimate cloud services (Dropbox, OneDrive, Google Drive) because URL reputation tools trusted them. Then GitHub, then Discord's CDN, then the whole cottage industry of using Notion, Airtable, and other SaaS platforms for C2 and payload hosting.
AI platforms are the next logical stop on that train, and they're arguably the most powerful station yet. The trust users extend to Claude and ChatGPT isn't just "this seems like a real website" — it's active enthusiasm. People share Claude links the way they share Google Docs. The recipient doesn't approach it with the same skepticism they'd bring to an unsolicited email attachment.
What's missing from most coverage of this Huntress research is the institutional dimension. These platforms are being onboarded by enterprises at speed, and the security community hasn't caught up with governance frameworks. Most org-level AI policies I've seen focus on data exfiltration risk — employees pasting sensitive information into prompts. The inbound threat vector, where AI platforms serve as distribution infrastructure for attacks *against* those same employees, is dramatically underaddressed.
Anthropic, OpenAI, and their peers have abuse teams, and they're working this problem. But the economics aren't in their favor: creating a shareable Artifact or conversation link costs nothing, detection requires content analysis at scale, and the attack surface grows every time a new sharing feature ships. Platform-side mitigation will always lag attacker iteration.
The defenders who get ahead of this are the ones treating AI platform traffic with the same nuanced policy they apply to file-sharing services — not blocked wholesale, but monitored, sandboxed where appropriate, and subject to behavioral rules that catch the payload stage regardless of where the lure lived.
— HackWire Editorial
---
## Related Coverage