The entry point is user-generated material hosted beneath a familiar AI product domain: a shared conversation, custom GPT or published artifact. A visitor may mistake the host's authenticity for endorsement of the content and follow attacker-selected installer or verification steps. ANY.RUN groups 320 public analyses around these chains; the figure…
Inspect the ClaimsCase · DiggingBeagle record
User-created AI artifacts and shared chats carry malicious installation lures
Untrusted shared conversations, custom GPTs or published Claude artifacts can sit on authentic AI-platform domains and redirect viewers to attacker installers or fake verification. The hosting identity is not vendor endorsement.
Scope
Trusted-domain branding via user-generated content
Assessment profile
Assessment method- Exploitation
- not established
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is unknown; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-AI-SHARED-LURE-01 · ANY.RUN: counterfeit AI products and malicious onboarding campaigns
At a glance
Originating account attribution and number of successful victim executions are unverified; user-generated material is not authenticated platform instruction.
Limits and uncertaintyFull account
The entry point is user-generated material hosted beneath a familiar AI product domain: a shared conversation, custom GPT or published artifact. A visitor may mistake the host's authenticity for endorsement of the content and follow attacker-selected installer or verification steps. ANY.RUN groups 320 public analyses around these chains; the figure represents sandbox activity, not 320 proven infections or distinct victims.
This differs from counterfeit command-line documentation, which substitutes hostile terminal instructions, and from fake Claude download pages, which induce local PowerShell or mshta execution. Here the trust confusion begins inside apparently genuine platform-hosted sharing features. The source does not establish that the platform itself authored the lure or that any specific account was compromised.
Claims & evidence
CLM-2026-AI-SHARED-LURE-01ANY.RUN reports 320 public analyses linked to chains beginning on genuine shared AI chat/artifact platforms or touching linked lure infrastructure, some leading to stealer installations.supported
Basis: reported finding
- supportsANY.RUN: counterfeit AI products and malicious onboarding campaignsprimary disclosure
Section When the Lure Lives on claude.ai or chatgpt.com
Unknowns and contradictions
- Originating account attribution and number of successful victim executions are unverified; user-generated material is not authenticated platform instruction.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153