Trusted AI Platform Domains Now Host Active Malware Across 29 Organizations

What happened

Why it matters

• ·Enterprise security programs that whitelist AI platform domains as trusted channels now carry a material blind spot: approved tools like Claude and ChatGPT can deliver malware through intended features, which means domain-reputation-based controls and most email security filters will not alert on the threat vector.
• ·Acceptable use policies and employee AI training programs must be updated to cover suspicious content hosted on AI platforms themselves, not only external or unknown URLs — a distinction most current policies and training curricula do not make.
• ·Vendor due diligence and AI tool approval workflows need to account for the ongoing attack surface created by each approved platform's shareable and public-facing features, not only the data-handling and privacy risks that dominate most current AI procurement risk assessments.

Governance controls affected

What to do now

• ☐Review your AI acceptable use policy to explicitly address malicious or suspicious content hosted on approved AI platform domains, and update employee training to reflect that trusted domain names are no longer a reliable safety signal.
• ☐Audit your network and endpoint security configurations to determine whether traffic to Claude, ChatGPT, and Grok domains bypasses content inspection or DLP controls, and close that inspection gap where technically feasible.
• ☐Add clipboard execution behavior and application allow-listing controls as recommended by Huntress, specifically targeting the execution patterns used by SectopRAT and AMOS stealer delivery chains observed in this research.
• ☐Establish a reporting channel and internal classification category for employees who encounter suspicious AI-hosted content, so that incidents do not go unreported because staff assume approved platforms are inherently safe.
• ☐Revisit your AI vendor risk assessments for Claude, ChatGPT, and Grok to document the residual risk from their shareable-content and artifact features, and confirm whether your vendor contracts address notification obligations if the platform becomes an active malware distribution channel.

What to watch next

Compliance teams should monitor whether Anthropic, OpenAI, and xAI update their terms of service, platform policies, or technical controls to restrict the shareable-artifact and conversation-URL features that enabled these attack chains. If the EU AI Act systemic-risk provisions are applied to these platforms, regulators may require documented controls specifically addressing misuse of public-facing output features. The Huntress findings may also prompt updates to the OWASP Top 10 for Large Language Model Applications, particularly around indirect prompt injection and malicious content delivery through trusted AI infrastructure. Organizations should also watch for threat intelligence updates as the documented malware families are well-established and likely to be adapted for additional AI platform delivery chains beyond the three documented here.