If you work in an AI tool all day, drafting capability statements, tightening proposals, building decks, you need one rule on paper before the next browser tab opens: nothing your team uses is allowed to tell them to paste a command into Windows. Here is the short version of a recent report, and the steps that cost a small contractor very little.
What was reported?
On October 8, 2026, an IT administrator at a managed service provider posted on Reddit's r/msp forum about a user at a client organization. The user was in ChatGPT, turning a PowerPoint into investor material. A message appeared in the chat saying the service had elevated automated traffic and needed extra security verification. It was signed "OpenAI Security Team" and linked to a page imitating a verification service. Source: Reddit r/msp report.
The page copied a command to the clipboard and told the user to press Win + X, open Windows Terminal, paste and press Enter. The command used PowerShell to fetch content from an attacker's domain and run it. The user tried twice, about 88 seconds apart. Endpoint protection ended the PowerShell process both times, and the managed detection provider found no sign that a payload downloaded or that anything persisted.
The administrator does not know why the message appeared. Prompt injection, another kind of conversation manipulation and an unsafe response were all listed as possibilities, none confirmed. They say they are not claiming OpenAI was compromised. OpenAI has not commented publicly as of October 10, 2026. Treat this as one team's report.
What is ClickFix?
ClickFix is a social engineering technique. A fake verification or error message persuades the person to paste a command into the Windows Run box or a terminal, so the person launches the attack themselves. It is documented by Microsoft (August 21, 2025) and by Proofpoint (November 18, 2024). Sources: Microsoft Security blog; Proofpoint security brief.
Why is an AI tool a convincing place for this?
Because people trust the window. If an instruction appears in the assistant they use for real work, it reads as part of the work. In this report the fake notice appeared inside a conversation on the real ChatGPT site, and it showed up more than once while the user tried to finish a presentation.
For a contractor, that matters because proposal and pricing work often happens in a hurry, against a deadline, with files uploaded to whatever tool is open. Hurry is what this technique relies on.
What belongs in a one page AI tool policy?
- 1
Name the approved tools
List which AI tools staff may use, and who approves a new one.
- 2
Say what may be uploaded
Decide what kinds of documents are allowed in, and what is not. If you are unsure whether something is sensitive, treat it as sensitive until you check your contract.
- 3
Write the paste rule
No website, CAPTCHA, chatbot or security notice ever requires pasting a command into Windows. If one asks, stop and call IT.
- 4
Say who to call
Put one phone number or email on the page, so nobody has to decide who to ask.
- 5
Make reporting normal
A person who clicked and then reported it quickly did the right thing. Say that in writing.
What should I confirm with my IT provider?
Ask three questions this week, and keep the answers in writing:
- Is endpoint protection installed on every computer that touches work, and can it stop a malicious PowerShell command?
- Who sees an alert, and how fast does that person act?
- Where do we record a blocked attempt, so we can show later that we noticed and handled it?
In this report, the endpoint protection was the control that held. That is the control worth checking first.
Not sure your current setup would catch this? We can review your endpoint protection and your AI tool rules alongside your GSA readiness.
Talk to Our Team
