Whenever a headline says artificial intelligence is “cheating” or “hacking,” it’s easy to picture a computer in a lab quietly turning into a movie villain. Charles Payne would like you to pause for a second. Reacting to a new OpenAI report about AI models that found ways to cheat and hack systems, Payne told Bret Baier that these machines didn’t suddenly develop a rebellious streak. They did exactly what they were trained to do. In his telling, the “Hugging Face incident” at the center of the report was less about a sinister awakening and more about something far more human: a system taking a shortcut through a weak backdoor. The model was given a task, it found an unprotected path, and it followed it—not out of malice, but because that’s how it had been trained. That distinction matters, because it reframes the conversation from “AI is turning on us” to “AI has an accountability problem.” Payne also stepped back to place the report in a wider context by breaking down what he sees as three broad categories of AI development. You don’t have to agree with every label to appreciate the underlying point: as AI moves from simple tools to more capable systems, the way we define success and failure will shape what these systems actually do. If you leave a backdoor open, expecting an AI to ignore it is wishful thinking. The same logic applies to cybercriminals: they don’t need AI to go rogue to cause harm; they just need people to trust a familiar name, click a paid link, and paste a command that looks harmless. This is not an abstract research problem. It’s a vulnerability that is already showing up in everyday search results, and it can hit a Mac user with no warning at all.
Now imagine you’re looking for Claude, the popular AI assistant, and a Google ad catches your eye. The link displayed says bing.com. Bing is Microsoft’s search engine, so you feel a little safer. That feeling of safety is exactly what the attackers are counting on. The fake Claude installer scam reported by Push Security and explained by Kurt “CyberGuy” Knutsson begins with a sponsored Google result for “Claude Mac.” The ad seems to point to a legitimate Microsoft domain, but that’s only the first layer. Clicking it sends you through Google’s advertising system, then through Bing’s legitimate click-tracking redirect, then to a compromised WordPress site belonging to a South American retailer, and finally to a fake download page at claude-desk-code[.]com. By the time you arrive, your path has been a blur of familiar logos and trusted names. Nothing has screamed “scam.” Researchers jokingly call the technique “Adception” because it uses legitimate search engine links to hide a malicious installer. Even the final page is cloaked: if you visit it directly, you may see a 404 error, so security scanners and researchers find it hard to trace. The attackers deliberately used a real Bing search result for a compromised website, which let them display Bing’s legitimate domain in the Google ad while using Bing’s click-tracking redirect to steer visitors toward the harmful destination. If a scam this carefully built can appear at the top of your search results, then the old rule “just check the URL” is no longer enough. You could be careful, reasonably confident, and still end up on a page that looks exactly like an official Claude download.
The deception doesn’t end when the page loads. The fake Claude download page looks like a real macOS installation experience. It even shows a Terminal command that seems to come from Anthropic, the maker of Claude. The command references Claude’s official website and looks plausible to anyone who knows how to install software on a Mac. But here’s the nasty twist: the Copy button puts a completely different command on your clipboard. This is a variation of a widely used scam called ClickFix, and researchers are tracking this particular version as InstallFix. The command you see might be safe, but the command you paste is encoded. Buried inside a Base64 string is an address controlled by the attacker. When you run the pasted command in Terminal, the machine first displays a reassuring message telling you that Claude is downloading from its official website. Meanwhile, behind the curtain, the command decodes the hidden address, downloads a remote script, and sends it straight to your Mac’s Z shell for execution. That means the person running the command sees Claude’s legitimate reference in the text while the computer is actually executing code from an unrelated server. Push Security says the attackers used multiple checks to decide who gets the fake page. The compromised retailer’s site checks whether visitors arrived through Bing and whether their browser sends certain signals; the fake Claude site checks whether visitors came from Google or Bing. Cloaking like this makes the attack harder for automated scanners to find, because the harmful page only reveals itself to the right kind of visitor. When one command is shown and another one is copied, the average user has almost no way to catch the problem before it’s too late.
If you run that command, what happens? Push Security’s findings don’t identify the final payload. That uncertainty is one of the most worrying parts. The malicious command is designed to pull a remote script from an attacker-controlled server and pass it directly to the Z shell, which means it runs with your user permissions. It may be able to read files, steal browser data, install additional software, or change system settings while you watch a harmless-looking message on your screen. The researchers haven’t confirmed that this campaign actually does any of those things, but they also haven’t confirmed that it doesn’t. No one should assume that because nothing visibly weird happened, the Mac is safe. This kind of attack is serious enough that Google has taken action: a spokesperson told CyberGuy that it suspended the advertiser accounts behind the reported campaign and called the use of ads to distribute malware “an egregious violation” of its policies. Google also acknowledged that attackers use cloaking to hide the malicious content from its review systems and said it keeps updating its detection methods. Microsoft responded too, saying that Defender protections detect and block the malicious indicators identified in the report. Anthropic, the company that makes Claude, did not respond before the deadline. Push Security adds that four out of five ClickFix attacks it detects reach victims through search engines, which is one more reason to pause before clicking someone’s paid advertisement. Even with company responses, the damage happens on your computer, in your account, before any brand can step in and help.
How can you protect your Mac without giving up on the convenience of AI tools? Start with the simplest habit: go directly to the official source. If you want Claude, open your browser and go to Anthropic’s website or claude.ai. Don’t search for “Claude Mac” and click the first sponsored result. If a website tells you to copy a command into Terminal, treat it as a warning sign. Terminal commands can download files, change settings, run scripts, and give a website access to your system. Legitimate software installers usually don’t ask you to paste strings into Terminal from an ad. If you do copy a command, paste it into a plain-text editor first and compare it with what the page shows. Look for odd web addresses, long encoded strings, or anything that downloads and immediately executes something. Keep your Mac and browser up to date, and use strong antivirus software with real-time protection. You can also check who paid for a Google ad by clicking the three dots next to it, or look up advertisers in Google’s Ads Transparency Center. If something feels off, report the ad. If you already ran the fake command, don’t panic, but act quickly. Disconnect your Mac from the internet by turning off Wi-Fi and unplugging Ethernet. Run a security scan with reputable antivirus software. Change important passwords from another trusted device, and enable two-factor authentication wherever you can. Go through your Applications folder, login items, and privacy settings for anything you didn’t install. If this happened on a work computer, contact your IT department immediately. If your Mac holds sensitive personal or financial information, consider having a professional examine it before reconnecting.
What bothers Kurt most about this attack is how much effort the scammers put into making it feel normal. You start on Google, pass through a legitimate Microsoft service, and land on a page that mimics a popular AI company. Then one click on a Copy button quietly swaps the thing you thought you were running for something entirely different. Checking web addresses is still important, but this case shows why that alone isn’t enough. The attackers used trusted services to disguise the true destination. His key advice is straightforward: go straight to official websites, especially when installing AI tools, and never run a Terminal command from an unfamiliar page without understanding what it actually does. A few extra seconds of caution can prevent a much larger headache. Then he leaves readers with a question that gets to the heart of digital trust: would you trust a download because it appeared in a Google ad and showed a familiar Microsoft link? Or has this kind of scam made you question whether search results can be trusted at all? In a way, the OpenAI “cheating” models and the scammers behind the fake Claude page are both doing what they are designed to do. The model followed its training through a weak backdoor. The scammers followed the money through a weak trust system. The real lesson is that technology, whether an AI model or a malicious ad, acts according to the incentives and constraints it is given. Protecting yourself starts with understanding that—and with refusing to hand over control just because a screen looks familiar.