Field Notes / AI Security
ChatGPT sent people to a fake download site. It kept doing it after the site went down.
A user asked ChatGPT for the official T3 Code download and got t33.codes, a near pixel-perfect clone registered 15 days earlier. The real developer could not get it to stop. Your staff ask AI assistants for download and login links every day. Here is how a two-week-old lookalike beats the real site, and what to change for your team and your own brand.
01 What happened
3 Code is an open-source control panel for AI coding agents. It runs on your machine and connects to tools like Codex. That makes its users developers with access to source code, cloud keys and, often, crypto wallets. Exactly the people an infostealer wants.
| When (UTC) | What |
|---|---|
| 19 Oct, 16:19 | t33.codes registered with Namecheap. One extra "3" |
| 3 Nov, 19:18 | Dorian Deacu posts the ChatGPT answer: "AI search is the new phishing vector". 170,000+ views |
| 4 Nov, 06:00 | Theo Browne: the clone "gets recommended by ChatGPT constantly" |
| 4 Nov, 06:47 | Browne: "Site’s down but ChatGPT is still recommending it" |
| 4 Nov, 06:59 | Registry status changes to client hold. The domain stops resolving |
The answer in the screenshot looks helpful. It recommends the official macOS app, explains that the app "updates normally", and labels the link "Official download". The preview card under it shows the clone, with the real product’s headline. Nothing in the answer would make a careful person stop.
What the download contained is still unknown. No sandbox report or
malware analysis for t33.codes had been published when we
went to press. Browne called the operators crypto scammers. OpenAI had
not commented publicly Tech Times 2026 .
02 Why the clone won
ChatGPT does not keep its own list of official websites. When it searches the web it builds an answer from search results, and much of that comes from Bing’s index. Whichever page looks most like the answer gets quoted and linked.
A T3 Code contributor looked at what the real site gave those engines to work with on 4 November. Very little t3code #30901 :
- No map.
/sitemap.xml,/robots.txt,/llms.txtand/.well-known/security.txtall returned 404. - Six pages. The real site had six indexable pages under a bare "T3 Code" title.
- No proof of ownership. No structured data said who publishes the product, and nothing linked the site to its official GitHub repository.
- The clone answered more questions. ChatGPT cited the fake for "download", "privacy policy" and even "security policy" queries.
That explanation comes from the contributor’s analysis, not from OpenAI. The logic holds either way. An answer engine quotes the most complete source it can find on a product. If the official site is thin, a copy with more pages can become that source within days.
03 Not a one-off
The T3 Code case got attention because a well-known developer was the victim. The numbers show it is routine.
| Finding | Number | Source |
|---|---|---|
| Login domains suggested by an AI model for 50 brands that the brand did not own | 34% | Netcraft, July 2025 |
| Of those suggestions, domains that were unregistered, parked or inactive, so anyone could buy them | 28 of 97 | Netcraft, July 2025 |
| Answers from ChatGPT, Copilot, Gemini and Perplexity to bank and retail login questions that contained a malicious link | 1.7% of 2,905 | Netcraft, August 2026 |
| Packages recommended by AI coding models that did not exist, open for attackers to register | 19.7% | USENIX Security 2025, via Socket |
Netcraft’s 2025 test is the one to show your board. Nobody poisoned anything. The model "simply wasn’t accurate" Netcraft 2025 . Nearly a third of the domains it handed out were free to register. An attacker only has to buy them. By June 2026 Netcraft was finding live phishing pages inside the answers themselves. In one Copilot chat the first link offered was a Wells Fargo login clone Netcraft 2026 .
Developer tools are the favourite lure because developers hold the keys. In March 2026 Kaspersky documented sponsored search results for "Claude Code download" that led to fake documentation. The page told visitors to paste one install command. On a Mac it installed the AMOS infostealer, on Windows the Amatera stealer Kaspersky 2026 . The coding models themselves add a third route. In a study of 576,000 code samples, 43% of invented package names came back every time the same prompt was repeated Socket 2025 . Predictable mistakes are easy to squat.
04 What to change
Two problems, two owners. Your IT lead protects the people who ask the assistant. Whoever runs your website protects the answer the assistant gives about you. For an outside view of the first problem, a free security audit shows what one infected laptop would reach.
- Publish one approved source for every tool your teams install, and push installs through a managed portal where you can. "Ask ChatGPT" should never be the install process
- Block domains younger than 30 days at your DNS filter or web gateway. t33.codes was 15 days old when it was reported
- Tell staff that a link in an AI answer is untrusted, the same as a link in an email. Check the domain against the vendor’s GitHub or documentation before downloading
- Treat any instruction to paste a command into Terminal or PowerShell to install something as an attack until IT says otherwise
- Make sure your endpoint protection covers macOS. AMOS targets the Macs your developers use
- Serve a sitemap.xml and robots.txt, and submit the site to Bing Webmaster Tools as well as Google Search Console
- Add Organization and, for software, SoftwareApplication structured data, with sameAs links to your official GitHub and social profiles
- Give download, login, security and privacy their own pages. Answer the questions a clone would answer, before it does
- Register the obvious lookalikes of your domain and watch new registrations that copy your name
- Ask ChatGPT, Copilot, Gemini and Perplexity where to log in to your service and where to download your product, once a month. Write the answers down
This is phishing with a new sender. It looks trustworthy because your staff asked for it. Assume one of them will click. In a 14-day assumed-breach penetration test we show you what that one laptop reaches, from source code to cloud keys, and the change that cuts each path. Start with your Threat Map. Your red team. Within reach.
Questions readers ask
What happened with ChatGPT and the fake T3 Code site?
On 3 November 2026 a user reported that ChatGPT answered a request for the T3 Code download with t33.codes, a near pixel-perfect copy of the real site, t3.codes. The lookalike domain was registered with Namecheap on 19 October 2026. T3 Code’s developer, Theo Browne, said ChatGPT recommended the clone constantly and that it kept doing so after the site went down. The registrar put the domain on hold on 4 November.
Why does ChatGPT recommend fake websites?
ChatGPT’s web answers are built from search results, largely Bing’s index, and the model picks whichever pages look most relevant. A clone that copies the real product’s text, adds download, privacy and security pages, and gets indexed can outrank a thin official site. Netcraft found in 2025 that 34% of login domains an AI model suggested for 50 brands were not owned by those brands, and 29% were unregistered or parked.
Was the t33.codes download malware?
No public analysis of the t33.codes download has been published as of 6 November 2026, so the payload is unknown. Theo Browne attributed the clone to crypto scammers. Comparable campaigns in 2026, such as fake Claude Code download pages reported by Kaspersky in March, delivered infostealers that take browser passwords, session cookies and crypto wallets.
How do I stop staff installing software from AI-suggested links?
Publish an approved list of download sources for the tools your teams use and require installs from it or from a managed software portal. Block newly registered domains, younger than 30 days, at your DNS filter or secure web gateway. Tell staff that a link in an AI answer carries the same risk as a link in an email, and check the domain against the vendor’s GitHub or documentation before downloading.
How do I stop a lookalike outranking my own site in AI answers?
Give search and answer engines something to rank. Publish a sitemap and robots.txt, add Organization and SoftwareApplication structured data with sameAs links to your official GitHub and social profiles, submit the site to Bing Webmaster Tools, and give download, security and privacy their own pages. Register the obvious lookalike domains and monitor new registrations that copy your name.
References
Sources
- Dorian Deacu (@doriandeacu). Post on X. 3 November 2026. x.com
- Theo Browne (@theo). Post on X. 4 November 2026. x.com
- Theo Browne (@theo). "Site’s down but ChatGPT is still recommending it." 4 November 2026. x.com
- pingdotgg/t3code issue #30901. Look-alike domain outranks t3.codes in search and answer engines. 4 November 2026. github.com
- Tech Times UK. ChatGPT recommends fake T3 Code site. 4 November 2026. techtimes.co.uk
- Netcraft. Large language models are falling for phishing scams. 1 July 2025. netcraft.com
- Netcraft. Threat actors are finding their way into your AI summaries. 3 August 2026. netcraft.com
- Kaspersky. Fake AI agents spread infostealers. 12 March 2026. kaspersky.co.uk
- Socket. Slopsquatting: how AI hallucinations are fuelling a new class of supply chain attacks. 2025. socket.dev
Close the gap this note describes
- Penetration testing You see the way in an attacker would use today, how far it reaches and what to close first.
- Free audit We map what you expose to the internet and send back the routes in, ranked by what each one reaches.
- Dark web check for partners For IT providers: name one client and we sweep breach dumps and forums for their leaked credentials.
