ChatGPT and Claude desktop apps: safe download rules for your team

For owners and managers in European companies where staff install AI tools themselves. The two official sources, a table of places to avoid and what to do if someone already ran a command.

·6 min read·Mateusz Cieśliński
AI securityShadow AIChatGPTClaude
A laptop showing a safe and a warning download window, with the Enter key highlighted but not yet pressed.
In this article7

Get the ChatGPT desktop app only from OpenAI's site (chatgpt.com/download) or the Microsoft Store, and Claude only from claude.com/download or the Microsoft Store. As of 28 October 2026, three research teams have described campaigns in three weeks where an ad, a page on the real claude.ai domain or a GitHub repository led to malware instead.

For a company, the risk goes beyond one laptop. Password stealers also take saved sessions, which means open access to email, the CRM and shared drives. And AI desktop apps now get more access than a browser tab ever did.

Where to download the ChatGPT and Claude desktop apps

Each app has two official sources, and neither asks you to paste a command.

  • ChatGPT: OpenAI's site or the Microsoft Store. Right now chatgpt.com/download links to ChatGPT Classic and to the store, while chatgpt.com/features/desktop describes the new version. The new app for macOS and Windows has three modes: Chat, Work (documents, spreadsheets and presentations) and Codex for developers. The older app is now called ChatGPT Classic, and according to the OpenAI Help Center it still receives security patches.
  • Claude: claude.com/download, which is where claude.ai/download leads too, or the Microsoft Store. Builds exist for macOS, Windows x64 and ARM64, with a Linux beta.

There is one exception. Claude Code, a developer tool, is installed from the command line, but only by following Anthropic's own documentation, and you should type that address (code.claude.com/docs) yourself, because attackers copy the real command. For everyone else the rule is simple: a normal installer or the store, never a command.

How the traps worked in October 2026

All three campaigns start in a search engine. Someone types, say, "claude mac" or "chatgpt desktop app" and clicks the top result.

An ad leads to the real claude.ai domain. On 26 October 2026, Gen Digital, the company behind Norton and Avast, described fake Claude install guides published as public Artifacts and shared chats. These are features available to Claude users. The attackers then paid for Google ads pointing at them. On a Mac, the guide asked people to paste a command into Terminal, which installed a stealer that grabs passwords, session cookies and files. On Windows, it asked people to press Win+R, paste and hit Enter, which ran remote-access malware. Researchers call this trick ClickFix: the victim runs the attack themselves, so many protections never see it.

A GitHub repository poses as an app. On 27 October 2026, Check Point Research described GitHub projects presented as "GPT-5.6 Sol", "GPT-6 Astra" or "Claude Opus" desktop apps. The ZIP held a genuine, signed OpenAI or Anthropic executable plus a planted DLL file that the program loaded at start-up. In this campaign the final payload was a cryptominer. The researchers note the same loader could deliver anything else.

An ad wears a Bing address. On 9 October 2026, BleepingComputer reported a Push Security finding: a Google ad for "claude mac" pointed to a Bing redirect link. On the fake page, the "copy" button put a different command on the clipboard from the one shown.

The common thread? A familiar address no longer proves anything.

Diagram of three routes to an AI app: two via ads and GitHub end in infection, one via the official address is safe.

Which sources to reject: a table for your team

You can send this table to staff as it is. Valid as of 28 October 2026.

  • chatgpt.com/download, chatgpt.com/features/desktop, Microsoft Store (ChatGPT). From the vendor?: yes, OpenAI. What to do: install.
  • claude.com/download, Microsoft Store (Claude). From the vendor?: yes, Anthropic. What to do: install.
  • A claude.ai page with a user-content banner (Artifact or shared chat). From the vendor?: no, user content. What to do: close it, even if the address looks right.
  • An ad above the search results. From the vendor?: unknown. What to do: skip it and type the address.
  • A GitHub repository offering a ChatGPT or Claude "app". From the vendor?: no. What to do: do not download.
  • A software download site or an Android emulator. From the vendor?: no. What to do: not on company machines.
  • A guide saying "paste this into Terminal, PowerShell or Win+R". From the vendor?: not for desktop apps. What to do: close it and report it.

Why a desktop app raises the stakes

An AI desktop app now does far more than a chat window. Claude Cowork reads and edits local files, and ChatGPT's Work mode works with documents, connected apps and, with the user's permission, local files. That is why people want it, and why they search for it.

Demand is large. In the UK, "chatgpt download" gets 14,800 searches a month and "claude download" 8,100, according to Google Ads data up to September 2026. Where there is traffic, criminals buy ads.

Some public bodies are already drawing lines. Since 26 October 2026, Sweden's Government Offices have blocked the browser versions of ChatGPT and Claude on work computers and pointed staff to Microsoft Copilot, as Euronews reports. You do not need a ban. You do need a decision.

The good news is that both vendors planned for company roll-outs. Anthropic offers MSIX installers for Windows and PKG for Mac, admin control over updates and sign-in through company SSO. An admin can push the ChatGPT Windows app from the store or as an MSIX package, for example via Microsoft Intune. OpenAI's documentation says there is no standalone MSI or non-Store EXE for the app, so any such file other than the Microsoft Store installer linked from chatgpt.com deserves suspicion.

What this means for your company

Conclusions first, then steps.

Confirmed conclusion: in October 2026, three independent teams (Gen Digital, Check Point Research and Push Security) described campaigns impersonating the ChatGPT or Claude apps. Two of them started with a paid Google ad. Source: reports dated 9, 26 and 27 October 2026.

Probable conclusion: companies where staff have local admin rights and install software themselves are the most exposed. In a business of 10-200 people with no IT team, that set-up is common. Source: Check Point Research says the dropper needed administrator rights. Note that the ClickFix method Gen Digital describes works without them, which is why "never paste commands" is a separate rule.

Hypothesis to test: the new ChatGPT app with Work mode will push up searches for "chatgpt download", and with them the number of trap ads. In the UK, "chatgpt desktop app" rose from 1,300 searches in June to 5,400 in September 2026. Source: Google Ads via DataForSEO.

What to do this week

Five steps. The first two take fifteen minutes.

  1. Send your team one message: the two official addresses, the table above and the line "no desktop app asks you to paste a command".
  2. Decide who installs software. The simplest route is to remove local admin rights from everyday Windows accounts and name one person who approves installs.
  3. Move staff to company accounts. A personal account inside a desktop app is still shadow AI, meaning a tool outside company control. We cover setting up a shared plan in our guide to Claude Team for business. If you already pay for Microsoft 365, look at Copilot Business first.
  4. Write down what happens if someone already ran a command: disconnect the machine, change passwords from another device starting with email, sign out of all sessions, switch on two-factor authentication, tell whoever handles IT. If customer data may have been exposed, check your GDPR breach duties with your adviser.
  5. If nobody looks after your tools, read how companies without IT staff split this work. You can also go through settings, installs and accounts with people who do it daily, through AI administration, so your team understands what was set up and why.

We are not a security firm and we did not analyse any malware samples. This article relies on reports from Gen Digital, Check Point Research and Push Security and on OpenAI's and Anthropic's own pages. If you suspect an infection, call a security specialist.

Sources

Questions & Answers(FAQ)

From OpenAI's site (chatgpt.com/download, with the new version described at chatgpt.com/features/desktop) or from the Microsoft Store on Windows. The new ChatGPT app for macOS and Windows has Chat, Work and Codex modes, while the older ChatGPT Classic still gets security patches. Installing it never involves pasting a command. If a page asks you to paste something into PowerShell or the Run box, close it.

From claude.com/download (claude.ai/download leads to the same place) or from the Microsoft Store. Anthropic offers builds for macOS, Windows x64 and ARM64, plus a Linux beta. Be careful with other pages on claude.ai: public Artifacts and shared chats are made by ordinary users, and that is where fake install guides appeared in October 2026.

No. The claude.ai domain also hosts user content: public Artifacts and shared chats. On 26 October 2026 Gen Digital reported criminals placing Claude install guides there and promoting them with Google ads. An Artifact carries the banner "Content is user-generated and unverified", and a shared chat shows a similar unverified-content notice. The official sources are claude.com/download and the Microsoft Store.

Disconnect the computer from the network and do not sign in to email, banking or company systems on it. From a different, clean device, change passwords starting with email, sign out of all sessions and switch on two-factor authentication. Tell whoever looks after your IT. Gen Digital says the Mac version stole browser passwords and session cookies.

As a start, yes: install AI apps only from the two vendor pages or the Microsoft Store, and never paste commands from a guide. Next, remove local admin rights from everyday Windows accounts so one named person approves installs. Then move staff to company accounts instead of personal ones, which gives an admin visibility and control.

About the author

Mateusz Cieśliński - Co-Founder, DevOps Engineer

Mateusz Cieśliński

Co-Founder, DevOps Engineer

Matthew Cieslinski is a co-founder and DevOps Engineer at AppWave, a software house that builds AI systems that companies actually use. He specializes in cloud infrastructure (AWS), container environments (Docker) and the operational side of AI deployments - so that they work stably in production, not just in the pilot phase. He operates from Lodz, Poland.

LinkedInView profile on the team page

Got a similar process on your side?

If something in this article sounds like your day-to-day - let's talk. We'll tell you plainly what can be improved, and what's not worth touching.

Let's talk about your project

Services related to this topic

Customer service automation

Not another chatbot. An agent wired into your email, CRM and knowledge base that takes over repetitive work.

Your IT team on a monthly plan

Five subscriptions, zero order? We take over licences, access and security. One partner, one invoice.

AI implementation review

Before you spend anything - we show, in numbers, where AI pays off and whether it's legal.