Fake custom GPTs used to push ClickFix PowerShell attacks

Attackers have been using custom GPTs, the personalised versions of OpenAI's ChatGPT that anyone can create and share, to impersonate legitimate products and trick users into running PowerShell commands on their own machines, according to a SecurityWeek report published on 29 September 2026.

The technique is known as ClickFix. In the cases described by SecurityWeek, the attacker-built assistants posed as real software products, and users who interacted with them were led to execute PowerShell, the command-line tool built into Windows. The report frames the abuse as a delivery route for malware rather than a flaw in the ChatGPT platform itself.

That distinction matters for defenders. Nothing in the report points to a bug in OpenAI's software being exploited. Instead, the attackers appear to have used the product as intended, publishing assistants under names and branding that were not theirs, and relying on the trust users place in a page hosted by a well-known AI vendor. The root cause here is tool misuse: a legitimate feature turned into a distribution channel.

The SecurityWeek item is short and does not say how many custom GPTs were involved, which products were impersonated, how many users were affected, what malware was ultimately delivered, or when the activity began. It also does not say whether the assistants have since been removed. The Agentic Times has not seen a statement from OpenAI on the activity, and the report does not include one.

What is clear from the report is the shape of the problem. Custom GPTs are user-generated content that sits inside a branded, trusted interface. A chat window that answers in the vendor's own voice is an unusually persuasive place to stage a social engineering lure, because the usual warning signs people are taught to look for, such as an odd domain name or a poorly written email, are absent. The instruction to open PowerShell and paste in a command is the same trick that has been delivered through fake browser error pages and bogus captcha prompts; only the wrapper has changed.

For security teams, the practical takeaway from the reported activity is narrow but useful. A support assistant that tells a user to run a shell command is a red flag regardless of where it is hosted, and organisations that can block or alert on PowerShell launched from a browser session or clipboard paste will catch this class of lure whatever the front end looks like. Staff guidance that names specific phishing formats may need updating, because the lure now arrives inside an AI chat rather than in an inbox.

On present evidence, this is a case of an AI platform being used as a stage for a conventional attack, not of an autonomous agent going wrong. Whether that assessment holds will depend on further detail from OpenAI or from researchers tracking the campaign. Until then, the reported facts support one conclusion only: the presence of a recognised vendor's branding around a chat interface is not evidence that the instructions inside it are safe to follow.