Your chatbot just asked you to paste something into Windows. Stop.

What should I do if a chatbot asks me to paste something into Windows?

Stop. Close the page. Do not paste anything. Then tell the person who looks after your computers, or call a local provider if you do not have one.

No real website, CAPTCHA or security check needs you to paste a command into Windows to prove you are human.

What happened to the person this was reported about?

An IT administrator at a managed service provider described it on Reddit's r/msp forum (Reddit r/msp report). A user was working in ChatGPT, turning a PowerPoint into investor material. A message in the chat said the service had elevated automated traffic and needed a security check. It was signed "OpenAI Security Team" and linked to a page imitating a verification service.

The page copied a command to the clipboard and told the user to press Win + X, open Windows Terminal, paste and press Enter. The user tried twice. Their endpoint protection stopped both attempts, and the security provider found no sign the attack got through.

Do we know why the chat showed that message?

No. The administrator says the cause is unknown. It could be prompt injection, another kind of manipulation or an unsafe response. They are not claiming OpenAI was compromised, and OpenAI has not commented publicly as of October 10, 2026. One team's report is not proof of a wider pattern, so do not panic about ChatGPT. Do learn the rule.

What is this trick called?

ClickFix. A fake verification or error message talks you into pasting a command into the Windows Run box or a terminal. You run the attack yourself, so nothing looks wrong until it is too late. It is documented by Microsoft in August 2025 (Microsoft Security blog) and by Proofpoint in November 2024 (Proofpoint security brief).

How do I spot it?

• It asks you to open Windows Terminal, PowerShell or the Run box. A website has no reason to ask for that.
• It tells you to press Win + X or Win + R and paste. Pasting is the step that runs the attack.
• It arrives with a trusted name on it. In this report the name was OpenAI's. A famous name proves nothing.
• It creates a rush. "Verify now to keep using the service" is the pressure.

Who do I call?

• If you have an IT person or managed provider: call them first and tell them what the screen said. Tell them even if you did not paste anything.
• If you pasted and pressed Enter: call them right away. Do not try the steps a second time.
• If you have no IT help: browse local providers and ask them the questions in our guide to choosing one.

What should a small business put in place this week?

• Say the rule out loud: nothing legitimate asks you to paste a command into Windows.
• Check protection: every computer needs endpoint protection that can stop a malicious command. It was the only thing between a click and a breach in this report.
• Decide which AI tools staff can use, and for what kind of information.

What if budget is the blocker?

See whether an in-kind grant can cover the work you need.